v1.3.2

A small patch release for 1.3.1.

The installed PWA shows the real icon again. Every icon in the web app
manifest declared a size that did not match the actual file. All three images
are 500x500, but they were listed as 48x48, 192x192, and 512x512. Chrome checks
the decoded dimensions against what the manifest claims and skips anything that
disagrees, so it skipped all of them and drew a generated letter tile instead.
The manifest now points at the icon set that really is exported at 16 through
512. The browser tab favicon and the iOS home screen icon had the same problem
and are fixed too.

An already installed PWA keeps its cached icon, so this mostly showed up on
fresh installs. If yours is showing a blank tile, uninstall the app, hard-reload
the page, and install it again. Updating the server alone will not replace a
cached icon.

The 512x512 icon also claimed to be maskable, which let Android crop it to a
circle. The logo runs edge to edge, so that crop was cutting off the key and the
flippers. That flag is gone.

npm audit is clean. Six advisories were open, all in dev and build
dependencies, so nothing deployed was exposed. Electron moved from 39.8.10 to
41.10.7 to clear a symlink path traversal in extract-zip and a sandboxed
iframe popup bypass. Electron 41 needs better-sqlite3 13, which moved the addon
to Node-API, so the native module no longer has to be recompiled for each
Electron ABI. @humanfs/node, @xmldom/xmldom, browserslist, and fast-uri
are all patched.

No database migration. If you are on 1.3.1, just update. Coming from 1.2.x, do
the 1.3.0 upgrade first.

Full details in RELEASE.md and CHANGELOG.md.