chore(connlib): check for non-resources early (#10984)

Avoids log-spam in the form of:

```
Dropping packet with bad source IP packet=Packet { src: fe80::223:a4ff:fe06:88c8, dst: ff02::16, protocol: "IPv6-ICMP", icmp_type: Unknown { type_u8: 143, code_u8: 0, bytes5to8: [0, 0, 0, 1] } }
```

chore(connlib): check for non-resources early (#10984)

Avoids log-spam in the form of:

```
Dropping packet with bad source IP packet=Packet { src: fe80::223:a4ff:fe06:88c8, dst: ff02::16, protocol: "IPv6-ICMP", icmp_type: Unknown { type_u8: 143, code_u8: 0, bytes5to8: [0, 0, 0, 1] } }
```

chore(connlib): set `user.account_slug` for Sentry logs (#10815)

By default, the Sentry SDK doesn't include custom user attributes when
it sends logs. To make viewing logs easier, we add the `account_slug`
attribute to all logs that are posted to Sentry.

feat(fz-cli): better secret handling (#10709)

This improves the secret handling inside `firezone-cli` by using the
`rpassword` crate to hide the token from stdin and using `secrecy` to
zeroize the memory afterwards. To make it easier to test locally, we add
a dry run mode for local testing, hidden behind the `FZ_DRY_RUN` env
variable.

refactor(swift): revise event-loop (#10573)

This is a follow-up from #10368 where we revise the forwarding logic in
`runSessionEventLoop`. Redundant logs are removed and the only exit
conditions from the event-loop are now the closing of either the event
or the command stream. The event-stream will only close once `connlib`
has successfully shut down and the command stream will only close of the
adapter shuts down (and thus drops the sender-side of the channel).

fix(connlib): handle resources changing site (#10604)

Similar to how resources can be edited to change their address, IP stack
or other properties, they can also be moved between different sites.
Currently, `connlib` requires the portal to explicitly remove the
resource and then re-add it for this to work.

Our system gets more robust if we also detect that the sites of a
resource have changed and handle it like other addressability changes.

To ensure that this works correctly, we also extend the proptests to
simulate addressability changes of resources.

Resolves: #9881
Related: #10593

fix(apple): Explicitly hide network extension from the UI (#10581)

Apparently if we set the CFBundleDisplayName we hint by default that
we *do* want to show it on newer macOS versions.

This seems to have been uncovered by Xcode 26 build recently.

Fixes #10579

chore: publish gateway 1.4.17 (#10584)

fix(apple): Explicitly hide network extension from the UI (#10581)

Apparently if we set the CFBundleDisplayName we hint by default that
we *do* want to show it on newer macOS versions.

This seems to have been uncovered by Xcode 26 build recently.

Fixes #10579

chore(android): tidy up AuthViewModel (#10372)

- removes unused authFlowLaunched var
- store long authUrl in val