docs(changelog): memoize deterministic API response redactor (#5204)

CHANGELOG.md

@@ -32,6 +32,7 @@
 
 ### Fixed
 
+- **Dashboard/session polling no longer pegs the CPU re-redacting identical payloads.** Repeated polls re-requested the same unchanged session payloads, and the combined credential redactor (~15 regex passes per string) was the dominant CPU cost under concurrent polling — enough to wedge the single-process server behind the GIL and surface as a "connection lost" in the browser. The redactor is pure and deterministic, so it's now memoized (`lru_cache`, identical input → identical output, no invalidation needed); a 16 KB per-entry cap routes giant tool-output dumps around the cache so they can't evict the recurring small strings or balloon memory. Redaction output is byte-identical to before — every existing redaction test still passes, and a new contract test pins `cached == uncached` plus the oversize-bypass path. Thanks @ducnhung70. (#5204)
 - **The WebUI server no longer wedges under a reconnect storm — it sheds load instead.** The stdlib threading HTTP server minted a worker thread per request with no live cap, so a burst of reconnects (a flaky network, a client retry loop) could pile up threads and wedge the whole instance in `ThreadingMixIn.process_request()`. Request dispatch is now bounded by a worker-slot semaphore: requests above the cap get a fast `503 Service Unavailable` (connection closed cleanly, input drained, bounded reject path) instead of spawning unbounded threads, and every worker slot is released in a `finally` so a handler exception or dropped connection can't leak capacity. Normal below-cap load is unchanged, TLS-handshake isolation is preserved, and the file-descriptor soft limit is raised best-effort for persistent hosts. Thanks @rodboev. (#5215, fixes #5210)
 - **Session saves no longer fail intermittently on Windows when a file is briefly locked.** On Windows, `os.replace()` raises `WinError 5` (access denied) when the target session JSON / index is momentarily held by another process (an antivirus scanner, the browser polling the file, etc.), which could abort a save. All session-state replaces now go through a helper that retries on `PermissionError` with exponential backoff (50 → 100 → 200 → 400 ms, 5 attempts) on Windows; non-Windows platforms are unaffected (single attempt, no delay), and a genuinely persistent error still surfaces rather than silently succeeding. Thanks @silent-reader-cn. (#5196)
 - **Cmd/Ctrl+K no longer hijacks kill-line (and other editing keys) while you're typing.** The global Cmd/Ctrl+K "new conversation" shortcut now early-returns when focus is in a text field (`INPUT` / `TEXTAREA` / `contentEditable`), so Emacs-adjacent users get kill-to-end-of-line in the composer and other editable fields instead of a new chat. Outside text inputs, Cmd/Ctrl+K still creates a new conversation exactly as before. Mirrors the existing Cmd/Ctrl+B sidebar-toggle guard. Thanks @nankingjing. (#5208, fixes #5099)