Prevented TOTP code reuse by recording transmitted codes in success events (HMAC-SHA256 hashed). Complies with RFC 6238, section 5.2.

Corrected caching and relations of well-known app link files. Added `delegate_permission/common.handle_all_urls` to `assetlinks.json` for compatibility with Google Pixel devices.

Added full support for the ZITADEL Support IDP in the Console, allowing creation, editing, and instance-role mapping.

Fixed malformed redirect URLs in Login V2 when `login_hint` resolves to an organization with an external IdP. Added support for SAML POST auto-submit in the same fast-path.

Restored automatic redirect to external IdPs for unknown users when enumeration protection is active, ensuring indistinguishable behavior between existing and non-existing users in IdP-only organizations.

Ensured the registration organization is resolved consistently with the login policy resolution order.

Login V2 now correctly shows the account selection screen after an RP-initiated logout if accounts are still present in the sessions cookie.

Restored the ability to use `urn:zitadel:iam:org:roles:id:{orgID}` scope for downscoping in token exchange. Inherits existing filters when omitted to prevent re-widening.

The `WellKnown.AppLinksCacheControlMaxAge` setting (`ZITADEL_WELLKNOWN_APPLINKSCACHECONTROLMAXAGE`), introduced in v4.17.0, is removed. Existing configurations keep starting but the value is ignored as files are now always served with `Cache-Control: no-store`.