v1.0.7 — Security & correctness fixes

What's changed

Security

• Escape all user-controlled field values to prevent XSS/SSRF via DomPDF

Fixes

• Preserve rich text rendering (Bard/Markdown) with a safe tag allowlist
• Guard against empty items and zero max_items
• Deduplicate PDF generation logic
• Add separate excluded_forms config option
• Enforce strict_types

Housekeeping

• Updated .gitignore to exclude non-package files