v0.1.27

v0.1.27 — critical privacy hotfix: cross-user data leak on desktop

Fixes a confirmed real bug: on a shared or reused desktop install, a
different person logging in inherited the previous user's locally-cached
tracked hours (via the offline-safety local session cache, which was
never cleared on sign-out or a fresh login) and saw them merged into
their own "Tracked today" / "This week" / daily chart totals. Server-side
data scoping was never affected — this was a pure client-side display
bug. Fixed by clearing the cache at every real re-authentication
boundary, while fully preserving the offline-safety guarantee for the
normal same-user-restart case.

Also fixes the compact widget's sign-out button, which previously only
cleared the auth token and skipped stopping the active timer and
resetting the sync engine's credentials.