v0.19.0 — audit fixes

Issues filed from the end-to-end audit, fixed one at a time.

The built PDF is only fetched from the site you signed in to (#8). The compile reply names the host to download from, and it was used as given. It is the one value in any response that decides where an authenticated request goes. It is checked against the site now, and anything else is ignored and logged.

Worth noting: the check compares against the site, not the exact host, because Overleaf's real answer is a sibling of www and not a child of it. Signed in to www.overleaf.com, the build comes back on clsi-a1b2.overleaf.com. The first version compared full hosts and would have broken every real PDF download. The test caught it before it shipped.

Settings that cannot be saved say so (#9). It used to fail in silence, so every box came back empty next time with no explanation and nothing in the log. It still never raises, since an export does not need the settings file, but it now logs the reason and says so once in the window.

Closing the window no longer leaves a stray callback. The queue pump rescheduled itself every 80ms and nothing cancelled it, so shutting the window fired one more callback against widgets that were already gone.

Why the certificate fallback sets an environment variable is now written down (#10), closed without a code change. The call that fails is inside a dependency and takes no CA bundle argument, so nothing set on our own session reaches it, and it only ever fires on a Python where nothing was verifying anyway. Three tests hold the guard.

The short-screen window limit (#11) is still open.

pip install --upgrade "overleaf-comments-export[gui,pdf]"