v0.1.3

Fixed

• The API key is no longer left in the environment when AUDIOBOOKSHELF_URL is
  unset. loadConfig deleted it only at the very end, behind the early return
  for a missing URL, so in that state the key stayed in process.env for the
  whole process lifetime — readable in /proc/<pid>/environ and inherited by
  every child process. The deletion now happens before any branch.
• A malformed AUDIOBOOKSHELF_URL is no longer echoed into the log. That branch
  fires precisely when the variable does not hold a URL, which most often means
  the API key was pasted into the wrong variable.
• http://[::1]:… no longer produces the "plain http to a non-local host"
  warning. URL.hostname keeps the brackets around an IPv6 literal, so the
  loopback check never matched that notation.