1.0.5

• Fix REST Settings::rest_update_settings TypeError on non-JSON request bodies
• Move admin capability grants to plugin activation/deactivation hooks (no longer runs on every request); now correctly handles multisite network activation
• Unify capability model on edit_blockshots for frontend access, REST routes, and Settings endpoints
• Tighten REST route matching (was a fragile str_contains)
• Return 404 instead of wp_die(403) for unauthorized frontend access; falls back to wp_die if the theme has no 404 template
• Cache the block-template file read with is_string() guard against file_get_contents failures
• Harden filename derivation (decode entities + strip tags + explicit site charset)
• Add Update URI: false plugin header to prevent wp.org name-collision overwrites
• Consolidate editor + frontend export pipelines into a shared module; export now clamps scale to [1,4] and quality to [1,100]
• Frontend: fix DOMContentLoaded race when script is footer-enqueued; defensive blockshotSettings defaults; translated aria-label; wp_set_script_translations for both editor and frontend handles
• Frontend: drop React createRoot for the icon (inline SVG)
• Canvas block: declare supports.multiple: false; remove attribute back-fills that dirtied legacy posts on open; read user settings as render-time fallback
• setDpi: warn once per session when JPEG has no JFIF APP0 segment to patch
• First test coverage: 17 Jest tests + 12 PHPUnit tests