upstream(rustdesk-server): release-notes sources (one-off upgrade; not enrolled)

cc-ci-plan/upstream/rustdesk-server.md

@@ -0,0 +1,23 @@
+# Upstream sources — rustdesk-server
+
+| service | image | source repo | releases / changelog |
+|---------|-------|-------------|----------------------|
+| app | rustdesk/rustdesk-server | https://github.com/rustdesk/rustdesk-server | https://github.com/rustdesk/rustdesk-server/releases |
+| signal | rustdesk/rustdesk-server | https://github.com/rustdesk/rustdesk-server | https://github.com/rustdesk/rustdesk-server/releases |
+
+## Standing notes
+- **NOT enrolled** in the cc-ci weekly set (operator 2026-10-30: single client, maintenance contract
+  pending). Mirror `recipe-maintainers/rustdesk-server` exists + this registry entry so one-off
+  `/recipe-upgrade` runs and advisory scans work; if the client confirms, enroll via `/recipe-enroll`
+  (test suite + bridge + used-recipes weekly row).
+- Both services (`app` = hbbs, `signal` = hbbr) use the SAME image — always bump them together.
+- Docker Hub has stray `1.4.5-*` arch tags (pushed 2026-01-12, top-level `1.4.5` tag deleted, no
+  GitHub release) — an aborted/alias push, NOT a real version line. The real line is `1.1.x`;
+  GitHub "Latest" + docker `latest` agree (1.1.16 as of 2026-07-20). Ignore 1.4.5.
+- Recipe uses `-k _` on both hbbs and hbbr (enforces key verification, enforced-key mode since
+  1.1.11) and publishes host-mode ports 21115-21119 (hbbs) + 21117/21119 (hbbr) — direct
+  client connections, only 21118/21119 are the web-socket/http endpoints behind nothing; the
+  traefik labels on `app` are vestigial (hbbs has no HTTP :80 service; healthcheck commented out).
+- 1.1.15 raised **default bandwidth limits** and added auth-failure logging (fail2ban-friendly);
+  1.1.16 fixed **unauthenticated UDP punch-hole reflection/amplification abuse** + critical `mio`
+  0.8.5→0.8.11 issue + i32 overflow (peers offline 24.9–49.7d shown online).