Security

• /rlogin unregister now invalidates the "remember me" session. It only deleted the account row; the session row survived, and the session check never asked whether the account still existed. An unregistered player reconnecting from the same address was let straight back in — authenticated, with no account and no prompt to make one.
• Registrations are capped per address (security.registration, 3 per hour by default). Brute-force protection guarded guessing an existing password; nothing guarded creating accounts, so one address could claim every name on the server and grow the database without bound.
• Weak passwords are refused (security.password.reject-common). Length alone accepted 123456, and a player's own name — which is public.

Added

• Account recovery. /register now issues one-time codes, shown once. /recover <code> <new password> sets a new password and clears 2FA, so forgetting a password or losing an authenticator no longer ends at an administrator deleting the account — which handed the name to whoever registered it next.
• Events for other plugins. RLoginAuthenticateEvent fires when a player is actually free to play, which is the moment to give them things; PlayerJoinEvent fires while they are still frozen. RLoginRegisterEvent marks a genuinely new account. Both on the player's own thread, Folia included.
• rlogin-api is published through JitPack, so addons can compile against rLogin instead of copying class names.
• nLogin and JPremium/LoginSecurity importers. Both were stubs that threw, while /rlogin migrate offered them. Table and column names are discovered rather than assumed, and an unrecognised layout says so.
• Tests for the Paper half, which had none.
• Releases are built and published from the tag by CI.

Fixed

• security.password.bcrypt-cost had drifted under the wrong parent in the bundled config, so it was read as absent and quietly fell back to its default.