v0.2.13

Highlights

Security hardening from the June 2026 review (no critical/high; cargo audit
0 vulns across 681 crates). Network-fetch integrity: Ollama blobs verified
against their sha256 digest, downloads capped (16 GiB) and decompression
bounded (anti-bomb), streaming-SSE reader/​reply size-capped (anti-OOM).
Dashboard: all dynamic fields HTML-escaped + CSP/nosniff/referrer headers.
At-rest: config.json and SQLCipher backups written 0600 on Unix. Input:
WAV headers validated (reject sample_rate 0 / bad bit depth) so a crafted
file errors instead of panicking. See docs/SECURITY.md.

Full Changelog: v0.2.12...v0.2.13