v0.1.4

Security

• The server and CLI are built with Go 1.27.3, whose certificate verification
  rejects every chain through the eight emSign intermediate CAs whose keys
  were exposed in October 2026 — the protection for outgoing TLS (tracepad upgrade, the CLI and MCP against a remote server). The Docker image also
  moves its runtime base to distroless/static-debian13, whose CA roots no
  longer include emSign ECC Root CA - G3 or Sectigo's AAA Certificate Services, the two roots those intermediates chain to. Debian 13's zone data
  has no posix/ tree: set TZ=Europe/Berlin rather than
  TZ=posix/Europe/Berlin; every zone name without the prefix is still there.

Every commit since v0.1.3: v0.1.3...v0.1.4