v1.1.0 - Security Hardening + Desktop Shortcut + Browser Selector

What's New in v1.1.0

Desktop Shortcut & Browser Selection

• Cross-platform desktop shortcut creator (create_shortcut.py)
• In-app browser selector (gear icon in nav bar)
• Silent Windows launcher (no console window)
• Auto-generated icon assets (ico/png)

Security Hardening (Full Pentest & Audit)

• CRITICAL: Fixed CSP connect-src blocking API calls
• HIGH: Added POST body size limit (16KB)
• HIGH: Config file whitelist-only with type/length validation
• HIGH: DNS rebinding protection on all API endpoints
• MEDIUM: Constant-time hash comparison (timingSafeCompare)
• MEDIUM: Browser ID validation against known list
• MEDIUM: Added maxLength on integrity hash field
• LOW: Fetch timeout with AbortController
• LOW: Removed dead code

See RELEASE.md for full details.