v1.9.0

Changelog

• 3eeda64 feat(auth): store tokens in the real macOS Keychain via /usr/bin/security
• c883250 feat(logout): revoke the refresh token by default via the discovered revocation endpoint
• 4126b2e fix(discovery): reject cleartext non-loopback endpoints in the OAuth discovery doc
• b4ebe02 fix(http): route auth + API calls through a shared 10s-timeout client
• 780c197 fix(login): report the real token storage backend instead of always claiming the OS keychain
• b3556ce fix(npm): verify the downloaded binary against the release checksums
• 2d6ff7c fix(proxy): bind the local proxy to loopback and add a read-header timeout
• 98ff748 fix(sync): run the default cwd auth script only inside a configured flmnt project