core: global drag-drop guard (files dropped outside the dropzone no longer
navigate away). sdk: ship fluxfiles.min.js (~5 KB). laravel: upload no longer
500s on a null path — disallowed extensions return 403. Bump sdk + fm.js to
0.1.3 and the laravel→core constraint to ^0.1.3. See CHANGELOG.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>