1.2.3

Maintenance release: dependency advisories cleared and the Cloud AI vendor
wiring consolidated. No user-visible behavior changes.

Changed

• Cloud AI vendors are now defined by a single VENDORS descriptor table
  instead of per-vendor conditionals spread across four files. No behavior
  change — adding a vendor is one entry rather than a dozen edits.
  (#7)

Security

• Build-time dependency updates clearing five Dependabot alerts: postcss
  (path traversal, via vite/vitest), brace-expansion (ReDoS, two ranges via
  eslint and the coverage tooling), protobufjs (DoS, via onnxruntime-web),
  and sharp (inherited libvips CVEs, forced to ^0.35.0 by an overrides
  entry since transformers.js still requires ^0.34.5). None of these reach a
  vault: an esbuild metafile confirms sharp, protobufjs, and
  onnxruntime-node are absent from the shipped main.js, which uses the
  browser/WASM backend. No plugin behavior changes.