v1.4.3

Changelog

• 8bb5d20 docs(plan): note WithRetryCtx backoff follow-up from Task 2.5 review
• 097e2af fix(accounts): read DefaultAlias under lock; run tests with -race
• 8e9aa81 fix(accounts): stop exposing token file paths via accounts_list
• fa06bb5 fix(auth): revoke token at Google's endpoint, not just locally
• e34793e fix(auth): stop returning a token fragment from auth_info
• 7a5b2d6 fix(retry): detect googleapi.Error so retries actually fire
• f5c57d8 fix(server): bound outbound API calls with a request timeout
• cc7fbe3 fix(server): never trigger interactive OAuth on the request path
• ecbfcd7 fix(server): recover from tool-handler panics instead of crashing
• b2f7cc5 fix(server): sanitize upstream API errors before returning to client
• 5f35538 fix(version): make version a var and inject it at build time
• e4c590e fix: name auth_init (not auth_start) in account auth errors
• 38f5a46 refactor(services): stop retrying non-idempotent send/create operations
• e61ad19 style(auth): explicitly ignore deferred Body.Close error