v0.3.4

What's changed

• Add CAPTCHA (Turnstile / reCAPTCHA) on the auth forms
• Security: resolve CodeQL findings in auth redirect, ReDoS, and CI hardening

Platform notes

• Each archive contains just the self-contained hycanvas binary with the frontend embedded; see the README for setup (.env, PostgreSQL). The first-run wizard generates the configuration for you, and .env.example in the repository documents every setting.
• First run: ./hycanvas service start daemonizes the server (pidfile + logfile next to the binary; Linux, macOS, and Windows) and asks whether to set up in the browser or in the terminal. The browser wizard at /installation/step-1 is unlocked by the one-time access secret it prints; the CLI wizard asks the same questions right there. Other verbs: stop, restart, status, log -f. ./hycanvas start runs in the foreground.
• The macOS binaries are not signed or notarized. If macOS quarantines the download, run xattr -d com.apple.quarantine hycanvas or right-click the binary and choose Open.
• ffmpeg is only required for server-side video export; everything else works without it.

Full Changelog: v0.3.3...v0.3.4