Release v0.10.0 — safe local defaults · nazboyko/applypack

What's new

The dashboard no longer binds to every network by default. Running the project without Docker used to put an unauthenticated dashboard — jobs, resume text, cover letters, settings, the Telegram token form — on whatever network the machine was joined to. It now listens on loopback unless you say otherwise; Docker installs are unchanged, since compose already published the port on localhost only.
A fresh install starts without an AI key. Copying .env.example and running anything used to fail with ANTHROPIC_API_KEY: required, including the dashboard where that key is configured. The dashboard now starts with no credential at all and the AI engine tab tells you which engines are usable.
The "Running without Docker" README section was verified step by step on a clean clone and now says what it actually takes: DATABASE_URL is the only value you must set, and both commands run from the repository root.
package.json and CHANGELOG.md were re-synced with the tag history (both had stopped at 0.2.1 while tags ran to v0.9.0).

lint:types + npm test green — 688 tests, +5 covering the config schema.
Clean-clone install re-run with the fixes: the dashboard boots from .env.example verbatim with no API key, logs host: "127.0.0.1", answers 200 on loopback, and the LAN address is refused. 36 migrations applied to an empty database, 39 seed upserts, all dashboard routes and /static/*.mjs 200.
docker compose config confirms the web service still resolves WEB_HOST: 0.0.0.0.

PR #34
ADR 0013 / 0014 (engine chain resolves at runtime, so a boot-time credential check was redundant)