Release v0.23.0: OIDC kill-switch + prod-bootstrap guard + Runtime-panel refresh

Bumps `App\Meta::VERSION` to `0.23.0` and promotes the [Unreleased]
section in CHANGELOG.md to a dated [0.23.0] entry. Highlights since
v0.22.0:

- OIDC_ENABLED kill-switch (false / 0 / no / off) lets dev / on-prem
  deployments run on LOCAL_ADMIN_* alone without unsetting the Entra
  creds.
- Production bootstrap refuses to start (503 + Retry-After) when both
  sign-in methods are off; a misconfigured deploy fails fast instead of
  silently shipping an unreachable instance.
- Admin-only Runtime panel on `/` shows App version + Creator (sourced
  from `App\Meta`) instead of the PHP version; OIDC row reads
  enabled/disabled to match the Local admin row.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,15 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+Nothing scheduled.
+
+## [0.23.0] — 2026-05-07
+
+Quality-of-life release on top of `v0.22.0`: explicit OIDC kill-switch
+for dev / testing, a production-bootstrap guard against shipping an
+unreachable instance, and a refreshed admin-only Runtime panel that
+surfaces app version + creator instead of the PHP version.
+
 ### Added
 
 - **`OIDC_ENABLED` kill-switch for dev / testing.** New env var (default
@@ -17,6 +26,11 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   on-prem deployments route everyone through `LOCAL_ADMIN_*` without
   unsetting the Entra creds in `.env`. New `OidcClient::isExplicitlyDisabled()`
   helper and 6 lock-in tests in `tests/Auth/OidcClientTest.php`.
+- **`App\Meta` — single source of truth for app version + creator.**
+  New class exposes `Meta::VERSION` (`0.23.0`) and `Meta::CREATOR`
+  (`Alessandro Chiapparini`); bump alongside the release commit so the
+  CHANGELOG heading, the git tag, and the in-app Runtime panel stay
+  aligned.
 
 ### Changed
 
@@ -26,12 +40,10 @@ adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
   `LOCAL_ADMIN_*` is enabled. Stops a fully unreachable instance from
   shipping silently after a misconfigured deploy.
 - **Admin-only Runtime panel on `/` swaps contents.** Drops the `PHP`
-  row; adds `App version` and `Creator` (sourced from new `App\Meta::
-  VERSION` / `App\Meta::CREATOR` constants — keep in sync with the
-  release tag and the latest CHANGELOG heading). The OIDC row's value
-  vocabulary changes from `configured` / `not configured` to `enabled` /
-  `disabled`, matching the Local admin row, so `OIDC_ENABLED=false`
-  reads naturally. No leak-surface change — the gate
+  row; adds `App version` and `Creator` (sourced from `App\Meta`). The
+  OIDC row's value vocabulary changes from `configured` / `not configured`
+  to `enabled` / `disabled`, matching the Local admin row, so
+  `OIDC_ENABLED=false` reads naturally. No leak-surface change — the gate
   (`currentUser is not null and currentUser.isAdmin` from R01-N02) is
   unchanged, and `TwigViewTest::testHomeForAnonymousUserHidesRuntimePanel`
   was updated to assert that neither the new `appVersion` nor
@@ -283,5 +295,6 @@ R01-N09 (`SameSite=Lax` retained — `Strict` would block the OIDC
 callback), R01-N17 (concurrent-tab OIDC clobber is correct
 RFC behaviour), R01-N29, R01-N30, R01-N32, R01-N33, R01-N34.
 
-[Unreleased]: https://github.com/chiappa/sprint_planer_web/compare/v0.22.0...HEAD
+[Unreleased]: https://github.com/chiappa/sprint_planer_web/compare/v0.23.0...HEAD
+[0.23.0]: https://github.com/chiappa/sprint_planer_web/compare/v0.22.0...v0.23.0
 [0.22.0]: https://github.com/chiappa/sprint_planer_web/releases/tag/v0.22.0

src/Meta.php

@@ -20,6 +20,6 @@ namespace App;
  */
 final class Meta
 {
-    public const VERSION = '0.22.0';
+    public const VERSION = '0.23.0';
     public const CREATOR = 'Alessandro Chiapparini';
 }