v0.4.1 — Security audit remediation

Security Fixes

🔴 Critical: Tracker authentication was documented but never implemented

The TRACKER_API_KEY env var existed in CORS headers and SECURITY.md since v0.3.0, but the tracker never validated it. Every REST and WebSocket endpoint was wide open.

Fix: Added constant-time API key comparison (tracker/src/api-key.ts) and middleware enforcing X-API-Key on REST POST/PUT/DELETE, stats, and dashboard SSE endpoints. WebSocket upgrades validate ?apiKey= query parameter. Backward compatible — when TRACKER_API_KEY is unset, auth is disabled (dev mode).

🟡 CI supply chain hardening

Replaced unpinned npx eslint . with npm run lint.

🟡 SDK WebSocket auth support

Browser SDK WsTrackerClient now appends ?apiKey= when configured.

---

Full audit report: Reviewed by Hermes Agent - deepseek-v4-flash