## Highlights

- **`start-tunnel auth session kill` takes `--pubkey <key>` for each session to end**, in place of positional session IDs. The `auth.session.kill` RPC takes `pubkeys` in place of `ids`, and `auth.session.list` returns sessions as `{ pubkeys, tokens }`.

- Prevent Add device dialogs from opening before subnet data loads.

- **WireGuard configs can use a separate endpoint when StartTunnel is behind NAT.**
  The UI config dialog defaults to the browser URL's host and accepts an edited IP
  address or DNS name. CLI `device show-config --endpoint` supplies the same
  per-config override independently of the WAN address used for SNAT and forwarding.

- Forwarded ports no longer occasionally fail to accept connections because the host was using the port for an outbound connection.

## Important

Choose an endpoint reachable by the device; an HTTPS reverse proxy may not forward WireGuard UDP. The configured WireGuard port is retained. CLI config generation with a non-public WAN override requires `--endpoint`. Configs already installed on devices remain unchanged.