v0.4.0 — audit-driven polish

22 audit findings addressed.

Security / a11y

• XSS fix (repo name from activity feed)
• XSS fix (terminal echo)
• Visible focus indicators (WCAG 2.4.7)
• Skip link visible on focus (WCAG 2.4.1)
• aria-pressed on filter buttons
• Ticker duplicate aria-hidden

New capabilities

• Command palette (Ctrl/Cmd+K or /) with fuzzy search
• Light theme toggle
• Per-project pages at /projects/<slug> — 138 static routes
• RSS feed at /rss.xml
• Real favicon (animated cursor SVG)

UX

• URL-persisted filter state (?cat=py&q=nvme)
• Search highlights matched substring
• Logo no longer jumps on body click
• Mobile: push-chip overflow, 2-col catalog, hero wrap

Perf

• Fonts preload+onload swap (~300ms FCP win)
• LIVE preview CLS fixed + 429 fallback gradient
• content-visibility:auto on catalog
• Service worker bug fixed
• IntersectionObserver disconnects cleaned up

Full changelog: CHANGELOG.md