chore(release): v1.26.0

[ovander]

What and why

Release cut for v1.26.0:

• feat(jwtauth): expose token scopes and add RequireScopes #117: jwtauth.RequireScopes, SocrateClaims.Scopes() and ctxutil.GetScopes (closes jwtauth: expose the token's scopes (scope / scp) and a RequireScopes option #116)
• fix(bff): require UPDATE in the pending-login managed-schema check #118: WithPendingLoginManagedSchema checks the UPDATE privilege
• feat(conformance): Socrate fixtures for mocks and a nightly live conformance suite #119: the conformance package and the nightly live suite (closes conformance: a suite run nightly against a Socrate built from go-oauth2, exporting claim fixtures #101)

Changes in this PR:

• CHANGELOG.md: moves [Unreleased] under [1.26.0] - 2026-10-11 with a summary, and updates the compare links.
• README.md: the install snippet uses @v1.26.0.

How it was tested

• Changelog and README only; CI runs the full gate
• [Unreleased] moved under the new version

Compatibility

• Exported-API change: additive only:
  • jwtauth.RequireScopes, (*SocrateClaims).Scopes;
  • ctxutil.WithScopes, ctxutil.GetScopes;
  • the new conformance package.
• Behaviour change for existing callers:
  • ctxutil.GetScopes is now populated.
  • A role without UPDATE on a managed pending-login table is refused at start-up; such a role couldn't sign anyone in before.
• Breaking change: none.

🤖 Generated with Claude Code

https://claude.ai/code/session_01GKRxaeYxyDhmt42cehLsGA

---

Generated by Claude Code