chore(release): v6.13.8 (DO NOT MERGE)

[lstein]

DO NOT MERGE

This is the 6.13.8 patch-release branch, opened against main only so that CI runs against
it. Every substantive commit here is already in main (squash-merged); this branch carries those
fixes on top of the 6.13.x line together with the release version bumps. Merging it would replay
already-merged work and move main's version backwards.

What's new in 6.13.8

The only content change since v6.13.7 is a back-port of #9492:

fix(download): remove the download_queue REST API; block non-public URLs for server-side downloads

• Removes the general-purpose /api/v1/download_queue/* REST router. It accepted an arbitrary
  http(s) source and a destination path from any authenticated user, had no first-party
  consumer, and existed mostly as SSRF / path-traversal attack surface.
• Adds invokeai/app/util/ssrf.py. build_guarded_session() validates the peer address of the
  connected socket before the request is written, which is what holds against DNS rebinding and
  against host spellings that requests percent-decodes differently than we do. Every redirect
  hop is re-checked through a response hook.
• Rejects server-derived filenames (Content-Disposition, URL path) that are not a single safe
  path component — ..\evil, C:evil and a trailing .. all escaped the destination directory.
• Adds allow_private_download_urls and download_proxy settings, with proxy credentials
  redacted from the runtime-config endpoint.
• Scopes download and model-install socket events to administrators; they carry source URLs and
  server-side paths.

Downloads the server performs on its own behalf — model installs from URLs — keep every one of
these protections.

Back-port notes

The release line is ~105 commits behind main, so several hunks needed adapting. Each is a
deliberate deviation from the upstream commit, not a merge artifact:

1. sockets.py — install/download events are addressed to admin sockets, not the admin
   room. Upstream can use the room because it joins it in _handle_connect; on this branch the
   room is only entered on subscribe_queue. Using the room here would have dropped these events
   for the whole connect→subscribe window, and permanently for any client that never subscribes —
   a regression against the previous unroomed broadcast. A _admin_sids() helper (from
   _socket_users, populated at connect) addresses them directly instead, leaving this branch's
   queue-event room semantics untouched.
2. sockets.py — model-load events stay broadcast. Upstream routes
   ModelLoadStarted/CompleteEvent to user:{user_id} before the admin check, but that came from
   a separate main-only commit and those events have no user_id field on this branch. Applying
   it verbatim would have made the loading-models spinner admin-only. Their config does carry
   path/source, but any authenticated user can already read those for every model via
   list_model_records, so broadcasting discloses nothing new.
3. test_model_install.py — _wait_for_restore_complete() takes no timeout and returns
   None on this branch, so the new regression test calls it accordingly.
4. test_invocation_event_socketio.py — the file is main-only, so it was recreated with just
   the tests that describe this branch's behavior. main's invocation-event tests assert a
   single room=["user:x", "admin"] emit; this branch still does two separate emits.

openapi.json, schema.ts and docs/src/generated/settings.json were regenerated from this
branch's backend. The schema delta came out identical to main's (285 / 325 lines), and the only
additions are the two new config fields.

Verification

• Full Python suite: 1961 passed, 106 skipped, 8 xfailed, 0 failed
• ruff@0.11.2 (CI's pin) check + format: clean
• Every new regression test confirmed to fail when its production fix is reverted
• An adversarial fresh-context review of the back-port caught the admin-room defect in note 1
  above before this branch was pushed; it is fixed and covered by a test here.

Known non-blockers (identical upstream, not introduced here)

• wait_for_installs() can still return with a job left in the non-terminal PAUSED state, via
  _download_cancelled_callback's resume-required path.
• The URL-derived-filename check has no direct test (the Content-Disposition path does).
• With download_proxy set, requests route through a separate ProxyManager, so the socket-peer
  guard does not run — the proxy is responsible for address policy, as the new docs state.