v1.1.1 — Security & Reliability Patch

What's changed

Security fixes

• FTPS: Certificate validation is now enabled by default. Self-signed cert support requires explicit insecure: true in config (previously always disabled)
• Config: Warns when password is read from the YAML file instead of .env

Bug fixes

• Deleted files now correctly respect exclude glob patterns
• Filenames with spaces or special characters no longer break uploads (null-terminated git output)
• Private key paths starting with ~ are now correctly expanded
• Remote sync state hash is validated before use — corrupted state files now give a clear, actionable error
• Temp files moved to os.tmpdir() with PID suffix to prevent race conditions on parallel runs

Improvements

• Connection timeouts added for both FTP and SFTP
• engines field added — requires Node.js >=16
• Protocol validation: unsupported protocols now fail with a clear error