v0.5.0-beta.1

Added

• laupin.ca app page now has a real "Buy a license" section: a $10 USD one-time purchase via a Lemon Squeezy hosted checkout (outbound link; the page stays static so the site CSP is unchanged), plus "after you buy" guidance to enter the key under About → License. Added a License screenshot slot and documented the required image files. The privacy policy now notes Lemon Squeezy handles payment data while the app itself remains offline with no account. (Key delivery is manual at launch; the checkout URL and screenshots are owner-supplied before go-live.)
• License management for licensed users: the License screen now shows the active license (email + key), a button to copy the key, and a confirm-gated "Remove license" action. Removing a license falls back to the free trial (and re-locks if the trial has already ended). Closes the gap where a licensed user could not move their key to another device or recover after a signing-key rotation.

Fixed

• Release APK now installs on Android 13/14 devices (e.g. Pixel 6). The release signing config produced a malformed v1 (JAR) signature alongside valid v2/v3 signatures; a present-but-invalid v1 block causes the modern installer to reject the APK rather than fall through to v2. Disabled v1 signing (enableV1Signing = false) — v2 has been the on-device standard since API 24 and minSdk is 26, so v1 added no compatibility while breaking installs. The signing certificate is unchanged.

Security

• Rotated the license-signing Ed25519 key from the development key to a production key generated offline (private half held only in the owner's secret store, never in the repo). The earlier development key's private half had been exposed during implementation, so it could not be used for real sales. This is the license-signing key (signs license keys), not the APK-signing certificate, which is unchanged. No real licenses had been issued, so nothing in the field is affected.