v0.3.0

⚠️ Breaking for library users

The pkg/ level is gone (#21). Update imports:
github.com/foxcool/psina/pkg/auth → github.com/foxcool/psina/auth (same for entity, provider, store, token, testutil, api).
The standalone binary and its config are unchanged.

Highlights

• Security: golang.org/x/net v0.60.0, golang.org/x/text v0.42.0 (GO-2026-6603, -6611, -6612, -6617, -6629).
• Fix: duplicate Register returns AlreadyExists instead of Internal; storage failures are no longer reported as "invalid credentials" by the local provider.
• Transport: h2c now comes from net/http (Server.Protocols). Prior-knowledge HTTP/2 cleartext (gRPC, Traefik h2c://) works as before; HTTP/1.1 Upgrade: h2c is no longer supported.

Changelog

• 804081f: fix(auth): typed errors from the local provider; bump x/net, x/text (#24) (@foxcool)
• eabfbb5: fix(build): bump Go images to 1.26, pin air (#20) (@foxcool)
• 54d64de: fix(ci): point security review at the ANTHROPIC_API_KEY secret (#22) (@foxcool)
• eeba87a: fix(ci): review every commit, not just the first one on a PR (#23) (@foxcool)
• 6ce48b4: refactor: flatten pkg/ into module root (#21) (@foxcool)