v0.7.3

Changelog

• 98fde01 Merge remote-tracking branch 'origin/main'
• 50bdca5 chore(release): bump to v0.7.3
• eec37b6 fix: inject build-time version via ldflags, add version consistency check (#276)
• 6afec9f fix: replace os.Exit(1) in doctor with exitcodes.CLIError return (#277)
• 07ae734 fix: use constant-time comparison for all token hash lookups (#275)
• 2febc1b perf: add mtime-validated cache for permissions/groups files + CanReadMany batch (#281)
• af16de8 perf: cache filtered snapshot payload per user with mtime invalidation (#280)
• e62a5c8 refactor: replace map[string]interface{} with typed result structs in service layer (#279)
• 74c1a35 refactor: split cmd/symdesk/commands.go into per-domain files (#278)
• 37eb3b6 security: add per-IP rate limiting for failed auth and share-token access (#274)