v0.1.3

Release 0.1.3

Turn on noUnusedLocals/noUnusedParameters

Bump happy-dom past the VM context escape

happy-dom <20 has the VM context escape (GHSA-37j7-fg3j-429f), and 15.x also
carries the unsanitized-export compiler flaw and the page-origin fetch
credentials. Dev-only; 406 tests pass on 20.

Give focus traps a stack, so two portalled siblings stop fighting

focusTrap guarded on container.contains, on the assumption that a nested
dialog is a DESCENDANT of the one it opened over. Every modal surface here
portals to document.body, so two open dialogs are SIBLINGS: each trap read the
other's focus as outside itself and pulled it back, and the focus bounced
between them until it settled in the outer one.

Only the topmost trap acts now. The token is pushed BEFORE the initial focus —
moving focus fires focusin, and a trap not yet on the stack had its own initial
focus reclaimed by the one below it. Release splices rather than pops, because
surfaces do not always close innermost-first.

Form's @submit also swallowed a rejection: command.run always resolves, but
validate() runs first and a validator that throws rejects there, leaving the
form doing nothing and a bare Uncaught (in promise) behind.

---

Changes since v0.1.2.