v0.3.7 — Narrow-screen panel clamp, DSH 0.2.0 compatibility window, and audit fix

修复 / Fixed

• 修复 Composer 思考面板在窄屏上定位出界：面板锚定触发器右边缘向左展开 336px，手机上模型按钮贴着屏幕左边缘，面板大半被推出屏幕、滑杆基本点不到；CSS 的 min(336px, 100vw - 32px) 只限宽度、限不了起始位置。现在面板打开时量一次触发器实际位置：原锚点位置放得进屏幕就保持不动（桌面行为完全不变），放不下时才把面板 clamp 到 [16px, 视口宽 - 16px] 区间内，窗口 resize 与页面滚动时重算。
• Fix the composer thinking panel overflowing the viewport on narrow screens: the panel is anchored to the trigger's right edge and opens 336px leftward, so on phones — where the model button sits flush against the left edge of the screen — most of the panel lands off-screen and the slider is essentially untappable; the CSS min(336px, 100vw - 32px) bounds the width but not the starting position. The panel now measures the trigger's actual position on open: the original anchor is kept whenever it fits the viewport (desktop behavior is unchanged), and only when it overflows is the panel clamped into [16px, viewport width - 16px], recomputed on window resize and page scroll.

安全 / Security

• 把开发依赖 jsdom 间接引入的 undici 从 7.29.0 提升到 7.30.0，修复 npm audit 报出的高危项（含 TLS 证书校验绕过 GHSA-w293-vg96-wgc3 等 2026-09-29 批次公告）。这些是 devDependencies，不进发布包的运行时依赖图（发布包只依赖 schemastery 与 yaml），因此对插件使用者没有暴露面；但 CI 的 npm audit --audit-level=high 在 quality job 内，publish 依赖它，不修会挡住下一次发布。@vitest/mocker 的 2 个 moderate 仍在，修复需要 vitest@5（破坏性变更），故不在本次范围内。
• Raised undici — pulled in transitively by the dev dependency jsdom — from 7.29.0 to 7.30.0, clearing the high-severity findings npm audit reported (including the TLS certificate-validation bypass GHSA-w293-vg96-wgc3, part of the 2026-09-29 advisory batch). These are devDependencies and do not enter the published package's runtime dependency graph (which is only schemastery and yaml), so there is no exposure for plugin users; but npm audit --audit-level=high runs inside CI's quality job, which publish depends on, so leaving it unfixed would block the next release. The two moderate @vitest/mocker findings remain, since fixing them requires vitest@5, a breaking change, and are out of scope here.

兼容性 / Compatibility

• 版本映射的最新窗口上界由 0.1.8-0 扩展到 0.2.1-0，使 DSH 0.1.7 至 0.2.0 整段落在同一个已验证的窗口内。0.2.0-rc.2 相对 0.2.0-rc.1 逐一核对过插件依赖的 API：设置控制器、configForms、plugin-compatibility、语言包与模型目录等文件逐字节相同，pi-ai 的 compatProfile 亦未变；该版本新增的 mistral-conversations 协议在 COMPAT_GATES 中提供 0 个字段，且不在 llm-pi-ai 的 PROTOCOLS 里，用户路由无法声明它，因此不改动插件的 18 字段集合。此前 0.2.0 落在窗口之外（未映射），插件仍可工作但会退化为跟随运行时报告的能力；现在它与 0.1.7 走同一条已验证路径。
• Extended the newest version-map window's upper bound from 0.1.8-0 to 0.2.1-0, so DSH 0.1.7 through 0.2.0 all resolve inside one verified window. Against 0.2.0-rc.1, 0.2.0-rc.2 was checked file by file on every API this plugin depends on: the settings controller, configForms, plugin-compatibility, the locale pack and the model directory are byte-identical, and the pi-ai compatProfile is unchanged; the one protocol that release adds (mistral-conversations) offers no field in COMPAT_GATES and is absent from llm-pi-ai's PROTOCOLS, so a configured route cannot name it and the plugin's 18-field set is untouched. Previously 0.2.0 fell outside every window (unmapped): the plugin still worked, but degraded to following the capabilities the running host reports. It now takes the same verified path as 0.1.7.