v2.0.2

Security update

Added optional SHA-256 pinning. Each app entry now has an optional sha256 field (in the Add/Edit dialog and the catalog schema). If set, the download is hashed, and the install is refused on mismatch.

One caveat worth remembering: this only makes sense for a fixed release you don't intend to keep auto-updating; every new upstream version has a different hash by definition, so leave it blank for apps you want tracking "latest" indefinitely (which is the normal case here).