Backend:
- PacketBatcher: cap latest_by_sender dedupe map (unbounded growth per
  long-lived map tab); prune 500 past a 5_000 cap by oldest timestamp
- PostgresNotifier: sync_connect: false + auto_reconnect: true so a DB
  outage can't crash-loop the node through the supervisor restart budget
- ShutdownHandler: drop synchronous Application.stop/1 deadlock; rely on
  System.stop(0) which stops applications in order
- SpatialPubSub: local_broadcast for per-subscriber spatial topics; in
  cluster mode a cluster-wide broadcast duplicates packets per node and
  can cross-deliver to a same-id remote subscriber
- PacketConsumer: log and broadcast inline when the shared task pool
  sheds work instead of silently dropping live packet broadcasts
- PacketConsumer: is_item now requires an actual itemname string —
  Map.has_key? flagged every non-object packet as an item
- DeviceCache: don't cache an empty device list for 24h after a failed
  or pre-population load; treat as a miss so next lookup retries
- ConnectionMonitor: sample cpu_sup in the long-lived process — calling
  it from a fresh Task returns a lifetime average, not an interval
- Packets.get_callsign_history: order DESC + LIMIT so the newest rows
  survive truncation, then reverse to the documented ascending order
- PromEx plugin: sum() not counter() for metrics carrying per-batch
  measurements (errors counted batches, not packets)
- InfoLive stations_heard_by SQL: first_digipeater CASE returned ||'*'
  but filters compare to  — always empty; also comma-delimit the match
  so W5ABC* doesn't match KW5ABC*
- LoginThrottle: don't reset the source-wide ip bucket on successful
  sign-in — it's the only bound on cross-account password spraying
- IPv6 rate-limit keys masked to /64 (RateLimiter.bucket_ip) across all
  throttles, the plug, and the mobile socket
- Browser pipeline gets its own rate-limit prefix (browser_rate_limit)
  instead of sharing 'rate_limit' with the :api pipeline
- MobileChannel: reject out-of-float-range integer bounds instead of
  ArithmeticError crashing the channel
- UserSessionController: 400 on non-string email/password instead of
  crashing Accounts
- UserSettingsLive: set changeset action :insert so password-change
  failures render the error banner

LiveView map:
- handle_params no longer re-runs the historical load on every
  self-issued patch (each pan cost two redundant DB queries + a
  clear-and-redraw)
- cleanup_old_packets recomputes the cutoff each sweep instead of using
  the frozen mount-time threshold
- HistoricalLoader resets historical_packets on a new generation so old
  windows can't merge into the unfiltered heat map
- BoundsUpdater sets initial_bounds_loaded so clear-on-pan is reachable
- PacketBatcher starts only for the connected mount (dead-render
  batchers idled for the HTTP keep-alive lifetime)

Frontend:
- ErrorBoundary ignores non-ErrorEvent resource-load failures — every
  failed tile <img> hid the whole map
- Tile retry keyed per tile element via WeakMap (keying by mutating src
  never reached the 3-attempt cap); strips old _retry params, skips
  detached tiles
- reconnected() re-sends map_ready + map state after LiveView rejoin so
  the fresh server process resumes streaming
- pushHistoryPatch called with the event arg LiveView 1.x expects
- removeMarker/withoutTrail no longer skip removal while the cluster
  group is detached (heat-map mode left permanent ghost markers)
- Trail hover: cancel debounce timer only when re-arming it — every
  second mousemove killed the RF-path hover permanently
- Weather charts read data-chart-labels (matching dataset key and JS
  key names); rain/gust/solar labels now sent server-side; dew point
  uses the °F formula on °F data; wind_gust serialized in history JSON
- InfoMap container marked phx-update=ignore so LiveView patches no
  longer wipe the Leaflet DOM

@@ -108,3 +108,3 @@
     # resolved client IP. Reading raw forwarded headers here would let an
     # untrusted client spoof its rate-limit bucket.
-    conn.remote_ip |> :inet.ntoa() |> to_string()
+    Aprsme.RateLimiter.bucket_ip(conn.remote_ip)