v0.4.3.1

What's Changed

• deps: offsite v0.2.1, off unpatched go-smb2 (GO-2026-5051) by @Yoshiofthewire in #99
• osv: ignore GO-2026-5932 (x/crypto/openpgp, not imported) by @Yoshiofthewire in #100
• deps: offsite v0.2.2 (SMB endpoint validation fix) by @Yoshiofthewire in #101
• Silver criteria: repeatable build check, release verification, coding standard, assurance case by @Yoshiofthewire in #102
• ci: build with the Go version go.mod names by @Yoshiofthewire in #103
• Bind the CSRF token to its session by @Yoshiofthewire in #104
• Refuse login iteration downgrades; upgrade older accounts on sign-in by @Yoshiofthewire in #108
• Bind encrypted content to its object, page and kind (content format v2) by @Yoshiofthewire in #109
• Add OpenSSF Best Practices and Scorecard badges by @Yoshiofthewire in #110
• Let admins run a backup deposit without step-up by @Yoshiofthewire in #111
• KyNotes: shared Appearance cards and suite shell scale by @Yoshiofthewire in #112
• Sync ky-ui 0.4.1 classic theme catalog by @Yoshiofthewire in #113
• Follow another tab's theme choice in Appearance by @Yoshiofthewire in #114
• chore(deps): bump modernc.org/sqlite from 1.60.1 to 1.61.0 in the go group by @dependabot[bot] in #105
• chore(ci): bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.1 in the actions group by @dependabot[bot] in #107
• chore(deps): bump the npm-build group in /web with 3 updates by @dependabot[bot] in #106
• Calm the workspace and Settings hierarchy by @Yoshiofthewire in #115
• Enforce the shared offsite SFTP policy in KyNotes by @Yoshiofthewire in #116
• Document secondary controls and isolate capture sources by @Yoshiofthewire in #117
• Refine KyNotes reading and phone page navigation by @Yoshiofthewire in #118

Full Changelog: v0.4.3...v0.4.3.1