v0.3.1

Rerun safety fix.\n\nChanges:\n- Preserve the target SSH port when rerunning the script, even if that port was only declared by the previous hardening drop-in.\n- Move UFW allow until after sshd validation/restart/listening checks pass, so failed SSH changes do not leave unused UFW rules.