v0.1.0-alpha.1

Security hardening update based on external review.

Fixes:

• Burns each approved proposal before contacting BigCommerce, preventing replay and concurrent duplicate writes
• Persists successful and failed-or-uncertain application evidence in a private .applied.json audit artifact
• Rejects literal, encoded, double-encoded and encoded-separator path traversal attempts
• Removes mutation application from MCP; approval and apply remain CLI-only so the approval secret stays outside the agent runtime
• Adds configurable request timeouts and HTTP 429 retry handling using BigCommerce rate-limit headers
• Reports remaining rate-limit state on responses and errors
• Tightens GraphQL mutation detection to inspect operation definitions instead of matching field text
• Handles multi-byte invalid approval codes cleanly
• Prevents caller headers from overriding the configured BigCommerce token

Verification:

• 23 tests pass on Node 20 and Node 22
• npm audit reports 0 vulnerabilities
• Package inspection contains no tests, credentials, operation artifacts or node_modules