docs: document the 5.4 release

[gantoine]

Docs for the upcoming 5.4 release (5.4.0-alpha.1 changelog). Every page was checked against rommapp/romm at 9ae2cd0e1, the commit that ends at #5142.

New pages

• install/upgrading.md: general upgrade steps, then a 5.3 to 5.4 section with the three release warnings (migrations, CORS, FORWARDED_ALLOW_IPS), the Viewer/Editor rename and a table of breaking API changes
• using/notifications.md: the inbox, channels (webhook with HMAC verification, email, Apprise) and the API
• administration/email.md: SMTP_* setup, and what email powers
• administration/audit-log.md: what's recorded, who can read it, retention and GET /api/audit-events
• administration/parental-controls.md: age limits, hiding unrated games, how a game's age is computed, with a rating mapping table
• administration/library-conversion.md: rom-converto, the converto config block, the Convert library task and ?format= downloads
• using/in-browser-play/easyrpg.md: RPG Maker 2000/2003 in the browser
• using/devices.md: browser profiles as devices, and installing games on a device
• ecosystem/retroarch-cloud-sync.md: RetroArch Cloud Sync over WebDAV

Updated pages

• Reverse proxy, environment variables, image variants, WebSockets (rewritten), device sync protocol, API authentication, the API reference (POST /api/tasks/scan), OIDC and authentication troubleshooting, netplay, saves and states, downloads, users and roles, scheduled tasks, search, languages, jukebox, metadata providers, the configuration file, the glossary and the nav.

Generators

• sources.toml is pinned to 9ae2cd0e1 because the 5.4.0-alpha.1 tag doesn't exist yet. Bump it to the tag before merging.
• gen_scheduled_tasks.py now reads the TaskSpec(...) entries that backend/tasks/registry.py declares inline. The old import-based parser failed against the new registry.

Where the docs differ from the changelog

The changelog doesn't match the source in a few places, and the docs follow the source:

• EasyRPG (and its RTP) ships only in the full image. Slim has no CDN fallback for it.
• FORWARDED_ALLOW_IPS had no effect before 5.4, because * was hard-coded.
• A hand-set "Alternative titles" list replaces the providers' titles for that game rather than adding to them.
• RetroArch is only offered saves that have no slot. States do cross over.
• "Download as" can offer lossy targets such as xiso. Only library formats are lossless-only.
• Failed sign-ins aren't rate limited per IP.

Checks

• trunk check is clean.
• mkdocs build has no link or anchor warnings.
• All redirect targets exist.

No screenshots yet. The changelog's screenshot placeholders weren't carried over.

🤖 Generated with Claude Code