[!CAUTION] This is a prerelease intended for test and experimental purposes only!

• Lock the _otps and _mfas system collections Delete API rule for superusers only. Record owners can still access the List and View endpoints in case you want to show history of the recent OTP and MFA attempts. If you have existing collections snapshot migrations you may want to delete and regenerate them or update manually the deleteRule to null in the snapshot for the _otps and _mfas collections.

• Reassign in the JSVM executors the global $app variable with the hook scoped e.app value to minimize the risk of a deadlock when a hook or middleware is wrapped in a transaction.

• Reuse the OAuth2 created user record pointer to ensure that all its following hooks operate on the same record instance.

• Added tags support for the OnFileTokenRequest hook.

• Other minor changes (added index for the _collections type column, added more detailed godoc for the collection fields and core.App methods, fixed flaky record enrich tests, etc.).