v0.6.3 — clean-pass polish

SheetDiff v0.6.3 — the clean-pass polish

The audit pass on v0.6.2 was the first clean pass — no CRITICAL, no HIGH findings. The SSRF guard survived a 42-probe attack on its hand-rolled hex parser, the richest-first ownership rule held on the real tracker in every Line List position, and the per-tab import suppression passed all divergent-timing fixtures. This release ships the pass's MEDIUM/LOW findings.

• ARCHITECTURE.md still taught the pre-0.6.2 ownership rule — "first tab in position order wins," the exact sentence describing the bug 0.6.2 fixed. A contributor refactoring from the doc would have reintroduced it. Rewritten to richest-first with the trade-off spelled out; also removed a phantom stoppages.ts module entry, fixed a garbled routes paragraph, and added /settings and the PDF route to the documented HTTP surface.
• The SSRF guard's IPv4-mapped matcher is now structural (the ffff hextet followed by exactly two more groups, zeros before it) rather than a prefix string — non-canonical spellings like 0:0:0:0:0:ffff:7f00:1 are caught too, and non-canonical tails are refused instead of misread (the 4-group path previously computed 0.0.0.0 and false-blocked a valid public spelling).
• Digest emails no longer double-list check findings from compilation tabs.
• Flash copy names the NOTIFY_ALLOW_PRIVATE_URLS=1 opt-in where users hit it; the onboarding "collection point" step acknowledges the automatic first baseline.
• knip is installed as a real devDependency and fully clean; the settings page drops a redundant query; doc test counts corrected.

394 tests + 7 E2E, all green. knip exit 0. Node 22+.