v1.6.0 — YouTube auth, ADA polish, security hardening, architecture refactors

What's new

New features

• YouTube cookie authentication for age-restricted content (yt-dlp cookie support)
• YouTube journal timestamps now use the video's upload date
• ADA legibility: chat display font bumped +2pt
• ADA accessibility: explicit tab order and accessible descriptions added to Contacts and Journal dialogs

Security & reliability fixes

• Fix: cap pending FCC lookups at 50 to prevent unbounded worker accumulation
• Fix: cap response-body reads to 1 MB in Gemini client and FCC/crossref fetchers
• Fix: move Gemini API key from URL query param to x-goog-api-key header
• Fix: guard delete_journal against path-traversal attacks
• Fix: replace print/traceback.print_exc with logging throughout
• Fix: guard test_voice against racing with a live TX on _tx_busy
• Fix: resolve all flake8 lint errors; improve yt-dlp error messages

Architecture refactors (SOLID / DRY)

• Extract SpectrometerManager, PendingStationManager, JournalController from MainWindow god class
• Add AppConfig.save() to invert save_json dependency from MainWindow
• Replace STTWorker public model attrs with typed ModelCache dataclass
• Add DEFAULT_OPERATOR_NAME / UNSET_FIELD constants; attendance_enabled setter
• Extract _build_*_rows() section builders from ConfigDialog.__init__
• Extract _set_frs_gate(), validate_voice_path(), _reset_journal_ui() helpers
• Define AudioInputSource Protocol for typed open_input_source return
• Register all PTT modes in _FACTORIES dict (open/closed principle)
• Replace contacts_dialog._now_iso with shared utc_now_iso from constants

Installation

Download gmrs-tty_1.6.0_amd64.deb and install:

```bash
sudo dpkg -i gmrs-tty_1.6.0_amd64.deb
sudo apt-get install -f # resolve any missing deps
```

Requires: Debian 13 / LMDE 7 (or compatible), x86-64, Python 3.13