Osprey v0.2.1 — the bundled backend actually works

Fixes the blockers in v0.2.0 — that build could not talk to its own bundled backend.

Two defects, either of which alone broke it:

• the webview's Content-Security-Policy still only allowed connections to
  localhost:8000, while the bundled backend listens on a random loopback port, so
  every request and the live-hotlist WebSocket were blocked
• the bundled backend runs as env=prod, where CORS is deny-by-default, and nothing
  named the Tauri webview as an allowed origin

Also in this build: only missing keys in secrets.json are regenerated (a partial file
previously discarded your encryption_key and orphaned saved connector tokens); a
corrupt secrets file no longer crashes every launch; the backend process is now
terminated on exit rather than leaked; and the sign-in screen shows real progress while
the backend starts instead of looking broken.

Install

• Windows — Osprey_0.2.1_x64-setup.exe or the .msi
• Linux — .deb, .rpm, .AppImage
• macOS — not published (needs Apple signing certificates)

Launch it and it starts its own backend — no Python, no Docker. First start takes a
few seconds; the sign-in screen says so. SmartScreen will warn (no Authenticode
certificate): More info → Run anyway.

Data lives in %APPDATA%\Osprey (Windows) · ~/.local/share/Osprey (Linux). Keep
secrets.json — its keys decrypt your connector tokens.

Still not in the bundled build

No background worker, so connected sources aren't polled on a schedule — use Refresh,
or run the Docker stack. OAuth connectors also need provider app credentials on the
backend.