Release v0.3.0

Feature-heavy release. New auth surface, a markdown zip export, a guarded re-convert flow, smarter async polling, a reorganized preferences pane, plus an honest pile of internal hygiene work.

✨ New features

• Optional authentication for protected docling-serve instances (#27). Three schemes — Bearer token, HTTP Basic, custom header (e.g. X-API-Key). Default is no auth, so existing setups are unaffected. Credentials are stored in the Zotero profile as plain text — flagged in SECURITY.md.
• Export markdown to .zip (#33). Bundle the converted markdown from a selection into a single flat .zip, ready to drop into Obsidian, a RAG indexer, or any downstream pipeline. Available both as a right-click menu item and via Tools → Docling: Export markdown to .zip…. If any selected item has no .md yet, a three-button dialog offers Skip / Convert first / Cancel. Files are named {citationKey}.md (Better BibTeX), falling back to {zoteroKey}.md.
• Re-convert confirmation dialog (#26, #35). The destructive Re-convert (replace) action now shows a confirm dialog by default, with a Don't ask again checkbox that flips the new confirmReconvert pref. The same pref is also exposed as a checkbox in the Behavior section so the opt-back-in path is symmetrical.
• First-run onboarding nudge (#29). One-time toast on first startup pointing the user at the preferences pane. Self-clears after the first successful Test Connection so it doesn't keep firing.
• Persisted Test Connection result (#29). Reopening the prefs pane repaints the last known server status (with timestamp) instead of an empty line.
• Smarter async polling (#25). When the async transport polls a docling-serve task and the server starts failing, an escalating warning surfaces a one-time toast after ~10 consecutive failures so a dead server isn't silent. Separately, an optional client-side wait ceiling (asyncMaxWaitMin) can now be configured — default is 0 = unlimited, the honest default given docling-serve has no cancel API.
• Processing-time in completion toast (#28). Batch toasts now show — took 4m 12s when at least one item completed successfully. Honestly labeled as server work-sum, not wall-clock.

🎨 UI

• Preferences pane reorganized into layered disclosure (#31). Essentials (Server, Behavior, Output) are always visible. Conversion options (Conversion + Enrichments + VLM) and Advanced (Async + Advanced JSON) are now collapsible sections, collapsed by default. Open-state persists across pane closes and restarts.
• Inline guidance added across the prefs pane (#31). VLM and picture-description preset menulists now have per-option tooltips and a live description line below the dropdown. Auto-convert, OCR languages, and Advanced JSON got clarifying help text.

🐛 Fixes

• Race condition in runBatch (#23). Two rapid clicks of Convert with Docling could both pass the in-flight guard and spawn duplicate batch orchestrators that fought over the shared progress window. The batchInFlight flag is now set synchronously before the first await.
• updateManagedHeadline body semantics clarified (#24). Parameter renamed to appendBody and documented to make it explicit that the body stacks rather than replaces. No behavioral change.
• CRLF handling in stripExistingFrontmatter (post-merge fix in 0.3.0). The function was dropping only a trailing LF after the closing ---, leaving a stray CR on CRLF input. Now consumes either.
• URL validation in Test Connection (#28). Missing scheme, non-http(s), and unexpected path components now produce concrete, actionable error messages instead of confusing low-level errors.

🧹 Internal

• Hygiene pass (#28). Dead code removed (src/utils/window.ts, empty onNotify stub in hooks). stripExistingFrontmatter wired in defensively so a server response that already begins with a YAML block doesn't end up stacking two --- headers. Node 20+ engine pin + .nvmrc.
• Test framework adopted (#32). Goldberg-style testing conventions (3-part test names, AAA structure, chai.expect, factories, property-based tests via fast-check). Covering tests for truncateMiddle, formatDuration, buildFrontmatter, stripExistingFrontmatter, buildConvertForm, and the markdown zip export helpers.

📚 Docs

• README install path now lists three options (uv / pipx / container) with explicit instructions for each (#29).
• README refreshed to match the new prefs layout, the opt-in async ceiling, and the renamed zip export feature.
• Community standards added in the run-up to this release: CONTRIBUTING.md, SECURITY.md, Code of Conduct, GitHub issue and PR templates.
• Contributors section in README auto-rendered from the GitHub contributors list (bots filtered out by the upstream service).

❌ Closed without landing

• First-class remote LLM API for picture descriptions (#30) — closed without merging because it conflicted significantly with the prefs reorg and the original PR didn't account for cost-burning when a user clicks a Test Remote API button against a paid provider. Detailed requirements + safety guardrails for any future re-implementation captured on issue #17.

---

Many of the PRs in this release were authored by @brianckeegan (against issues I had filed earlier this week). Thanks Brian.