v0.4.0

What's Changed

• deps: bump the minor-and-patch group with 5 updates by @dependabot[bot] in #57
• deps: bump the minor-and-patch group with 5 updates by @dependabot[bot] in #58
• deps: bump gradle-wrapper from 9.7.0 to 9.7.1 in the minor-and-patch group by @dependabot[bot] in #59
• deps: bump the minor-and-patch group with 5 updates by @dependabot[bot] in #60
• ci: bump actions/setup-java from 5.6.0 to 6.0.0 by @dependabot[bot] in #61
• ci: bump actions/upload-artifact from 5 to 7 by @dependabot[bot] in #62
• deps: bump com.android.application from 9.3.2 to 9.4.0 in the minor-and-patch group by @dependabot[bot] in #63
• deps: bump the minor-and-patch group with 8 updates by @dependabot[bot] in #64
• deps: bump the minor-and-patch group with 5 updates by @dependabot[bot] in #65
• deps: bump the minor-and-patch group with 7 updates by @dependabot[bot] in #66
• ci(stale): let the stale workflow actually close issues by @GeiserX in #67
• style(brand): same business jet as CashPilot in the launcher icon by @GeiserX in #70
• ci(stale): let the stale job save its progress by @GeiserX in #71
• docs(banner): new banner and social preview by @GeiserX in #69
• docs: give the README an install path and the standard sections by @GeiserX in #72
• docs: give the app a real site so a first visit lands on install and fixes, not a file list by @GeiserX in #73
• ci: bump actions/setup-java from 6.0.0 to 6.0.1 in the actions-minor-and-patch group by @dependabot[bot] in #74
• fix(security): stop sending the fleet key in clear text to public servers by @GeiserX in #75
• chore(beads): share the tracker setup without publishing bead text by @GeiserX in #76
• chore(beads): tell agents this repo tracks work in beads by @GeiserX in #77
• chore(git): keep Co-Authored-By trailers out of commits made with the beads hooks by @GeiserX in #78
• fix(git): make the commit-msg hook unable to lose a commit message by @GeiserX in #79
• chore(beads): name the tracker's remote by an alias, so this repo no longer says where it is by @GeiserX in #80
• fix(scripts): stop naming a private build host in a public repo by @GeiserX in #82
• deps: bump the minor-and-patch group with 4 updates by @dependabot[bot] in #81
• fix(security): let Android refuse plain http to every host but loopback and private names by @GeiserX in #83
• ci: run CI on every PR so the test check can be required on main by @GeiserX in #84
• fix(security): keep http to a LAN or Tailscale address working, with the URL policy as the gate by @GeiserX in #86
• deps: bump the minor-and-patch group with 3 updates by @dependabot[bot] in #87
• deps: bump the minor-and-patch group with 7 updates by @dependabot[bot] in #88
• fix(heartbeat): send device_type so the server stops treating phones as Docker hosts by @GeiserX in #89
• ci: bump the actions-minor-and-patch group with 2 updates by @dependabot[bot] in #90
• deps: bump the minor-and-patch group with 5 updates by @dependabot[bot] in #91
• fix(traffmonetizer): point the referral link at traffmonetizer.io, the old domain is gone by @GeiserX in #92
• fix(release): keep gradle.properties and the tag in step so F-Droid can rebuild the APK we ship by @GeiserX in #93
• build(docs): move the site to Zensical by @GeiserX in #94
• docs: stop the public CLAUDE.md naming local paths for the signing keystore by @GeiserX in #96
• deps: bump com.android.application from 9.5.0 to 9.5.1 in the minor-and-patch group across 1 directory by @dependabot[bot] in #95
• fix: earn referrals on four more sign-ups and make the APK rebuild byte for byte on F-Droid by @GeiserX in #97

Full Changelog: v0.3.0...v0.4.0