v0.1.13 — robustness fixes from a full audit + review

Robustness fixes surfaced by a full security audit and code-review pass of the server. No behaviour changes for valid input, and no security vulnerabilities were found — these are correctness/hygiene touches.

Fixed

• upload-file-from-url: an empty-string mimeType override no longer files a receipt with a blank content type (falls through to the response type; || not ??).
• A present-but-unusable Content-Disposition filename* (empty / control-chars only) degrades to the plain filename= instead of discarding it. RFC 6266 precedence preserved.
• get-document rejects an unknown voucherType cleanly via Object.hasOwn instead of letting a prototype key stringify into the request path.
• postMultipart classifies a mid-read failure after a 2xx like the other client methods.
• The default upload host allow-list is returned as a copy, not the shared module array.

Full detail in CHANGELOG.md.