v1.17.0

Changed

• better-sqlite3 13 (was 12.11.1). Its native binding uses N-API and ships inside the package for macOS (arm64, x64),
  Linux glibc and musl (arm64, x64) and Windows (arm64, x64): installing no longer runs prebuild-install or downloads
  a binary, installs with --ignore-scripts work, and a Node.js upgrade no longer breaks the binding ("compiled against
  a different Node.js version"). On any other platform the package still installs, but no binding is compiled any more:
  the server stops when it opens its database, with an error that names the platform and how to build the binding
  (npm run build-release in the better-sqlite3 package directory). The unpacked dependency is 27.3 MB (12.11.1:
  10.4 MB plus the one binary it downloaded). Bundled SQLite 3.53.4.
• Contributors add an entry to CHANGELOG.md for a user-visible change; the unused @changesets/cli dev
  dependency is gone (the repository never had a .changeset/ setup, and releases take their notes from this file).
• Releases are staged on npm instead of published directly: the release workflow runs npm stage publish
  (Trusted Publishing, provenance), and a version becomes public only when a maintainer approves it on
  npmjs.com with two-factor authentication; the workflow pins npm 11.20.0 for it (staged publishing needs 11.15.0+).
• The README opens with the Quantum Media Technologies wordmark and closes with a "Made by" line, both linking to www.qmediat.io/open-source; package.json homepage points there and author is the company line every qmediat package uses.
• SECURITY.md and docs/security.md name the company security mailbox security@qmediat.io (one address across
  every published qmediat package) next to GitHub's private reporting form.
• README.md gains a "Trademarks and affiliation" section: Gemini is Google's trademark; this integration is
  independent and not endorsed by Google; use of the Gemini API through it is subject to Google's terms.
• Development: the project builds with TypeScript 7 (the native compiler). The published JavaScript is byte-identical
  to 1.16.4 except dist/manifest/db.js (the better-sqlite3 error above); the type declarations describe the same types (only the order of union members and properties and the
  quote style differ) and the source maps are regenerated. The TypeScript 7 npm package ships only tsc — no
  tsserver and no JavaScript API — so an editor set to use the workspace TypeScript version cannot load it from
  node_modules; use the editor's bundled one.
• The release workflow asks npm once whether the version is already public and stops on any answer other than yes
  or no (a registry error used to read as "not public"); a new GitHub Release is a draft until the version is public,
  and a published one is never withdrawn on npm's answer (the run warns); the npm it runs is pinned by version and by
  the sha512 of its tarball; a failed stage is named in the run summary.