v0.2.0

What's Changed

🔒 Security

• crypto/rand for auth salt — replaced math/rand (not a CSPRNG) in Subsonic token generation
• HTTP response size cap — io.LimitReader at 10 MiB prevents OOM from malicious servers
• HTTP status check — 4xx/5xx responses now fail fast before JSON decode
• State file permissions — tightened from 0644 → 0600 (no longer world-readable)
• SPOTSONIC_PASSWORD env var — password no longer required on the command line (avoids ps aux exposure)

🔁 Reliability

• Retry with exponential backoff — transient network errors and HTTP 5xx retry up to 3× (1 s, 2 s); 4xx and API errors fail immediately
• Temp file cleanup — .tmp state file removed on failed os.Rename
• Report write errors surfaced — CSV write/flush failures in unmatched report are now logged instead of silently dropped
• State-save failure — logged at ERROR level instead of warning

✅ Correctness

• Fuzzy matcher rune-aware — similarity() now uses rune lengths (not byte lengths); fixes inflated scores for non-ASCII track names (CJK, Arabic, etc.)
• Case-insensitive CSV headers — column matching now tolerates track uri / TRACK URI etc.

📄 Docs

• Added AUDIT_REPORT.md (full security audit findings)