3.13.0

What's Changed

• fix: security hardening, logging cleanup, and code quality improvements by @snowsky in #115
• fix: Redis-backed rate limiting, silent exception logging, and observability by @snowsky in #116
• fix: replace brittle Alembic tenant URL string-replace with urlparse by @snowsky in #117
• fix: CSRF protection middleware and server-side auth verification by @snowsky in #118
• fix: pin deps, remove Pydantic v1 compat, add real unit tests by @snowsky in #119
• fix: two-phase encrypted search and private key memory isolation by @snowsky in #120
• build(deps): bump pypdf from 6.1.3 to 6.8.0 in /api in the pip group across 1 directory by @dependabot[bot] in #121
• refactor: split monolithic api.ts into domain-specific modules by @snowsky in #122
• refactor: split monolithic MCP tools.py into domain mixin package by @snowsky in #123

Full Changelog: 3.12.0...3.13.0