v0.1.3

安全

• Web 控制台重做鉴权：HMAC 签名会话 cookie（7 天有效期）替代固定值 cookie，修复未配置账密时提交空表单即可获得会话的漏洞
• 新增跨站请求伪造（CSRF）防护与 1MB 请求体上限；API 未登录返回 401 并自动跳转登录页
• 登录校验改用常数时间比较，防范时序侧信道

修复

• 修复默认数据库路径（相对路径 data/wxread.db）无法启动的回归 (#17)
• 推送渠道：HTTP 非 2xx、响应非 JSON 不再误判为推送成功
• 微信读书客户端：请求 70 秒超时防挂起；401 统一触发凭据续期；续期失败不再丢失已轮换的凭据
• 删除账号时连带清理其历史日志与阅读配置

变更

• 进程优雅退出：Ctrl+C 时先停止后台阅读会话并保留断点，再关闭数据库
• 阅读会话改为用户主动停止或上报失败后当日视为结束（断点仅用于异常退出恢复，次日自动开新会话）
• 首次心跳改为立即执行，不再等待 30 秒

其他

• 会话签名密钥持久化：升级后首次启动需重新登录一次，此后重启/升级不再掉登录
• 新增 web 包单元测试

What's Changed

• build(deps): update package hashes for v0.1.2 by @27Aaron in #12
• chore: apply gofmt formatting by @27Aaron in #14
• fix: harden error handling in store, weread client, and notify by @27Aaron in #15
• feat(web): signed sessions, CSRF protection, and request limits by @27Aaron in #16
• fix(store): resolve db path to absolute before building DSN by @27Aaron in #17
• feat(web): move farm sessions under server lifecycle by @27Aaron in #18
• feat(store): clear run checkpoint on stop and restrict resume to same day by @27Aaron in #19
• fix(store): purge logs on account delete and tolerate malformed legacy book_ids by @27Aaron in #20
• feat(web): persist session key across restarts and add web package tests by @27Aaron in #21
• chore: bump version to v0.1.3 by @27Aaron in #22

Full Changelog: v0.1.2...v0.1.3