PCA-100 1.1.0

[1.1.0] - 2026-08-24

Added

• In-app update check: on startup the app queries GitHub Releases and, if a
  newer version is available, offers a one-click download of the signed
  DMG. Opt out with PCA_NO_UPDATE_CHECK=1.
• Remote-access toggle in the app: off by default (local-only, loopback
  bind). Enabling it binds the API to the LAN and shows a connect URL and
  QR code for a phone or second machine; disabling it rebinds to loopback.
  The toggle takes effect immediately, with no restart.
• Signing identity for packaging is now read from the CODESIGN_IDENTITY
  environment variable instead of being hardcoded in the build scripts.

Changed

• Origin/Host guard hardening: the allow-list now accepts loopback and
  private/LAN IP addresses only, and no longer trusts DNS names such as
  .local/.lan/.home/.internal, which could be rebound to the
  operator's machine after the browser's same-origin check passed. A
  Host-header check now runs on every request, including the /api/live
  WebSocket handshake, closing DNS-rebinding attacks an Origin-only check
  would miss.
• The frontend Vite dev server now defaults to binding localhost instead of
  every interface, since the dev proxy has no auth of its own; set
  PCA_DEV_LAN=1 to expose it on the LAN.

Fixed

• Dark-sweep calibration rows are now validated against the unit's dark
  grid before use, instead of failing later during measurement.