chore: release v0.1.28

[github-actions]

🤖 New release

• cryptify: 0.1.27 -> 0.1.28

Changelog

0.1.28 - 2026-07-17

Added

• configurable email attribute type for the finalize sender check (#193)
• (metrics) require a bearer token on /metrics when configured (#177)
• persist rolling-quota usage to SQLite (usage_db) (#176)
• add GET /email-template endpoint keyed on API key (#175)
• (metrics) capture X-POSTGUARD-CLIENT-VERSION client identity (#174)
• (email) remove circle around signer-verified checkmark (#173)
• (email) replace unicode checkmark with inline PNG image (#172)
• (email) staging-only /staging/preview/ + shared render API (#171)
• (metrics) pre-seed known channels at zero on startup (#165)
• expose Prometheus /metrics endpoint for usage dashboards (#102)

Fixed

• retry the startup verifying-key fetch instead of panicking (#192)
• (cors) allow X-Cryptify-Source in browser preflights (#189)
• (email) larger, selectable download-link code block in recipient email (#187)
• return generic body from 5xx responses, log detail server-side (#185)
• require validated API key on GET /usage (GHSA-5rhx-xgvv-h78h) (#183)
• (cors) allow Office add-in origins (addin.postguard.eu + localhost:3000) and DELETE method (#179)
• (email) address postguard#197 deliverability + show disclosed signer name (#170)

Other

• extend CLAUDE.md with migrated agent notes (#190)
• update dependencies (#181)
• (deps) cargo update lockfile (#168)
• replace pkg_url with https://pkg.postguard.eu/ (#178)
• bump pg-core 0.6.0 → 0.6.1 (#164)
• add semantic PR title check workflow (#162)

Security

• require a validated API key on GET /usage and reject unauthenticated callers with 401 (GHSA-5rhx-xgvv-h78h)
• compare cryptify_token values in constant time, matching the recovery-token path

---

This PR was generated with release-plz.

[dobby-coder]

Standard release-plz bump from 0.1.27 to 0.1.28. Diff is limited to version bumps in Cargo.toml/Cargo.lock and a changelog entry for the dependency lockfile update. Looks good.