v1.10.0 — Security fixes, reliability hardening & dark-mode reports

What's new

Implements a full security/reliability audit backlog: nine bugs fixed, one offline-privacy gap closed, and a few UI improvements.

Security: a stored XSS vulnerability in the history and version-compare views — app names, versions, and AI summaries were written into the page unescaped and could run arbitrary script if a scanned APK's manifest (or the AI's own output) contained crafted HTML. All untrusted fields are now escaped.

Also fixed: a false "0/100 — Critical Risk" on JSON-uploaded reports, an AI-analysis timeout that could kill slow local models mid-response, a rate-limit retry message that could corrupt a saved report's verdict, a memory leak on long-running instances, a path-traversal gap on the report endpoint, unbounded upload memory usage, and a model-tier misclassification for cheap model variants.

Improvements: generated reports now support dark mode, icon-only buttons have accessible labels, truncated domain lists say so, and the update check no longer phones home when running fully offline (Ollama/LM Studio).

15 new tests added (68 total, all passing).