chore: bump v2.5.10 and update README for recent fixes

CHANGELOG.md

@@ -2,6 +2,23 @@
 
 All notable changes to World Monitor are documented here.
 
+## [2.5.10] - 2026-02-26
+
+### Fixed
+
+- **Yahoo Finance rate-limit UX**: Show "rate limited — retrying shortly" instead of generic "Failed to load" on Markets, ETF, Commodities, and Sector panels when Yahoo returns 429 (#407)
+- **Sequential Yahoo calls**: Replace `Promise.all` with staggered batching in commodity quotes, ETF flows, and macro signals to prevent 429 rate limiting (#406)
+- **Sector heatmap Yahoo fallback**: Sector data now loads via Yahoo Finance when `FINNHUB_API_KEY` is missing (#406)
+- **Finnhub-to-Yahoo fallback**: Market quotes route Finnhub symbols through Yahoo when API key is not configured (#407)
+- **ETF early-exit on rate limit**: Skip retry loop and show rate-limit message immediately instead of waiting 60s (#407)
+- **Sidecar auth resilience**: 401-retry with token refresh for stale sidecar tokens after restart; `diagFetch` auth helper for settings window diagnostics (#407)
+- **Verbose toggle persistence**: Write verbose state to writable data directory instead of read-only app bundle on macOS (#407)
+- **AI summary verbosity**: Tighten prompts to 2 sentences / 60 words max with `max_tokens` reduced from 150 to 100 (#404)
+- **Settings modal title**: Rename from "PANELS" to "SETTINGS" across all 17 locales (#403)
+- **Sentry noise filters**: CSS.escape() for news ID selectors, player.destroy guard, 11 new ignoreErrors patterns, blob: URL extension frame filter (#402)
+
+---
+
 ## [2.5.6] - 2026-02-23
 
 ### Added

README.md

@@ -1525,6 +1525,10 @@ Desktop release details, signing hooks, variant outputs, and clean-machine valid
 - [x] Ransomware.live feed added to cyber threat intelligence sources
 - [x] Browser Local Model toggle properly gated (ML worker only initializes when enabled)
 - [x] Linux AppImage crash fixes (WebKitGTK DMA-BUF rendering, console noise suppression)
+- [x] Yahoo Finance rate-limit UX (user-facing messages instead of silent failures across all market panels)
+- [x] Sidecar auth resilience (401-retry with token refresh, settings window `diagFetch` auth)
+- [x] Verbose toggle persistence to writable data directory (fixes read-only app bundle on macOS)
+- [x] Finnhub-to-Yahoo fallback routing when API key is missing
 - [ ] Mobile-optimized views
 - [ ] Push notifications for critical alerts
 - [ ] Self-hosted Docker image

package.json

@@ -1,7 +1,7 @@
 {
   "name": "world-monitor",
   "private": true,
-  "version": "2.5.9",
+  "version": "2.5.10",
   "license": "AGPL-3.0-only",
   "type": "module",
   "scripts": {