v0.1.1

Documentation-only patch closing the operator-guidance findings from the 2026-07-28 security scan. No runtime or public API change; the packed dist/ output is identical to 0.1.0.

• claimsFor and repairUserByEmail are named as privileged operations alongside provisionVerifiedUser; none may be reachable from unauthenticated traffic or a user-supplied principalId/email (F-01).
• Email change now carries explicit host obligations: authenticate the endpoint for the named principal, and require a fresh passkey assertion before beginEmailChange. The old-address notification is a detective control that arrives only after the change commits (F-02).
• The threat model records that authenticator attestation is deliberately not verified (attestationType: "none") (F-03).
• finishAccountCreation is documented as also authenticating existing accounts, so the creation endpoint needs sign-in-grade rate limiting, session policy, and anomaly detection (F-06).

Three findings were reviewed and disputed as non-findings, with reasoning in docs/securityscan.md: plaintext deliverable addresses at rest (F-04), deterministic HMAC-derived codes (F-05), and the credential-ID timing distinction in finishPasskeyAuthentication (F-07).