v1.0.2 — verifiable tests, safer origins

Nothing about the crypto or the share format changed. Shares written by v1.0.0 or v1.0.1 restore
here identically, and a key written by this version reads back in the older ones.

The vector tests now run in CI

The SLIP-39 implementation was always checked against the official vectors, but you had to take
that on faith. node test/run.mjs is now in the repo and runs on every push — all 45 vectors from
trezor/python-shamir-mnemonic, the BIP-39 English vectors, BIP-32 test vectors 1 and 2,
RIPEMD-160, and split/recover round-trips. 132 checks, and the badge at the top of the README says
whether they pass right now. The test vectors are committed, so you can run it yourself offline.

The buttons now refuse an address that cannot work

Opening the page at 127.0.0.1 or over file:// warned you in the banner but still let you start
a backup — which would then fail at the key, partway in. "Back up a seed" and "Restore a seed" are
now disabled in any environment where a security key cannot be used, including a bare IP, a
non-secure context, or a browser without WebAuthn.

A security policy

SECURITY.md sets out how to report a vulnerability privately, and what is in scope. Private
vulnerability reporting is enabled on the repository.

Documentation

The README now explains where the randomness comes from — one source, crypto.getRandomValues,
and what actually depends on it — and which primitives are hand-written because Chrome ships no
native for them.