v0.1.1 — Security Audit Fixes

Security Fixes

• .gitignore: add .env to prevent credential leaks
• setup_cookies.py: remove auto pip install, cookies via stdin, chmod 600
• dedup.py: fix merge direction bug (high-confidence events discarded)
• damai.py: MD5 signing risk annotated, APP_KEY to env var
• store.py: IntegrityError handling + scraped_at type safety

Bug Fixes

• dedup: 3-day window, 4-char prefix match
• normalizer: empty ID UUID fallback, exception logging
• hardcoded year to datetime.now().year
• base.py: redirect false, jitter backoff
• utcnow to timezone.utc
• source_name merge dedup