release: 2.3.0

[raspbeguy]

Promotes 2.3.0 to stable. Bumps VERSION to 2.3.0, retitles the CHANGELOG section to [2.3.0] - 2026-06-24, and regenerates build/openapi.json (info.version follows VERSION).

Final 2.3.0 surface (commit-confirmed apply was deferred out before stable, see #17):

• Known scope tree exposed via uapi-token scopes (+ --json) and the scope.known_paths() module export. Closes Expose the known scope tree for programmatic consumers #5.
• Per-token rate / burst overrides through POST /tokens and uapi-token create.
• Platform-fidelity fixes from the stock-config round-trip audit (PATCH preserves unmodeled options; several uci-field rules relaxed to match what stock OpenWrt ships).

This is a stable tag, so it publishes to the apk feed (unlike the rc1 pre-release). Validated on live hardware (192.168.10.123): scope tree, rate/burst, and the absence of the confirm surface all confirmed.

Gates green locally: lint, 756 unit tests, openapi-check.

🤖 Generated with Claude Code