v0.4.0 — security hardening + init --force

Security

• Path traversal protection — applied.json entries now bounds-checked against ~/.home before any fs.rmSync/cp. Entries outside home are skipped. (#111)
• Safe JSON parsing — applied.json reads in restore/uninstall/rollback now wrapped in try-catch with shape validation; clear error on corrupt backup instead of raw Node stack trace. (#111)
• Input validation — parseUserRef rejects empty username, empty ref, path separators, and .. traversal patterns. (#112)
• Cache path containment — fetchProfile verifies the resolved cache directory stays inside cacheRoot before any file/git operation. (#112)
• DOM XSS fix — stargazers_count from GitHub API now type-coerced before innerHTML in docs/index.html.
• Scanner improvement — bearer token regex narrowed to JWT prefix (eyJ) to reduce false positives from prose in docs.

Features

• init --force — overwrite an existing sharekit-profile/ directory (useful after interrupted runs). Without --force, the error message now says "Use --force to overwrite." (#110)

Dependencies

• @types/node upgraded to v26
• typescript upgraded to v6.0 (added "types": ["node"] to tsconfig)

Docs

• SECURITY.md new Trust Model section: sandboxing, path bounds enforcement, hooks trust model, applied.json note, symlink note (#104)
• README.md links to SECURITY.md

Tests

• 132 tests (was 109 in v0.3.0)
• New: test/backup-security.test.ts, test/fetch.test.ts
• New: --include-hooks tests with real hook fixtures, init --force coverage