merge: sync master into dev

Sync master into dev while preserving dev-specific feature logic and include the required co-author trailer.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

CHANGELOG.md

@@ -4,6 +4,25 @@
 - **Dokploy**: deploy production Compose from GitHub Actions with serialized rollout tracking, terminal-status handling, health verification, and deployment summaries
 - **GitHub Actions**: remove unrelated Docker image publishing and GitBook Pages deployment workflows
 
+# v0.5.40 (2026-07-20)
+
+## Features
+- **i18n**: add Khmer (km) translations
+- **CLI tools**: configure Grok Build subagent models
+- **Kimi**: merge OAuth into dual-auth provider, add K3 / K2.7 models
+- **Dashboard**: ProviderTopology flow animation
+
+## Fixes
+- **DB**: resolve better-sqlite3 parameter binding crash
+- **Translator**: pass `service_tier` through OpenAI → Responses conversion
+- **Kiro**: map GPT-5.6 reasoning effort fields
+- **Kiro**: validate terminal streams before emitting output
+- **Kiro**: map GPT reasoning effort fields
+- **Codex**: current `client_version` + refresh-aware model sync
+- **Alicode-intl**: split into Coding Plan + Model Studio providers
+- **Cursor**: HTTP/2 AgentService support + version bump 3.12.17
+- **Dashboard**: cut duplicate API/icon spam, lazy-load provider assets
+
 # v0.5.35 (2026-07-16)
 
 ## Fixes
@@ -14,7 +33,7 @@
 - **User quota**: show remaining Orbit and Codex headroom in the users table with session and weekly usage details
 - **Orbit Provider**: add Anthropic-compatible API-key routing for Claude Opus 4.6–4.8 models
 - **xAI**: Grok Imagine video generation (`/v1/videos`) + CLI
-- **CLI tools**: Grok Build setup — writes `[model.9router]` to `~/.grok/config.toml`
+- **CLI tools**: Grok Build setup — choose separate main/general-purpose/explore/plan models and preserve each model's context window
 - **GitHub Copilot**: route Claude models through Copilot's native `/v1/messages`
 - **Kiro**: add GPT-5.6 model family (#2596)
 - **RTK**: `X-9Router-Token-Saver` header to bypass token savers per request