1.0.1

Bug fixes, plus a change to how off-site images are handled.
Fixed

• The temporary copy written during an upload now lands in the folder Obsidian's own
  "attachment folder" setting points at. It previously always landed in the vault root,
  so uploads looked like stray image files piling up at the top of the vault.
• The "upload existing attachments" command no longer leaves a duplicate copy of files
  that are already in your vault.
• Caching off-site images now works in Live Preview, not only in reading view.
  The render hook Obsidian exposes only fires in reading view, so while editing — where
  most people spend their time — nothing happened at all.
• A cached copy now gets a real file extension (.png) instead of a fragment of the
  URL. Some image hosts put a dot in the last URL segment, so the "extension" used to
  become a long token; Obsidian does not display files whose extension it does not
  recognise, so the cache folder looked empty even though the files were there.
• Pasting an image no longer inserts the same picture two or three times.
  Changed
• Off-site images are no longer governed by a per-site prompt. There is now a default
  behaviour in the settings (skip, or cache) plus a way to choose per image: a command
  and a settings button open a picker and cache exactly the ones you tick. The old
  .site-decisions.json file is no longer read or written.
• The "upload existing attachments" command can also pick up images that notes link to
  somewhere else, not only files sitting in the vault.
  If you cached off-site images with 1.0.0
  Those copies were written with the token-style name described above. Re-caching them with
  1.0.1 produces properly named .png copies, which leaves the old ones unreferenced.
  Run Repair the local-copy index, then Clean up unused cache files, to tidy up.
  How far this has been verified
  Signing, key and path derivation, the upload chain, the caching chain and the cleanup
  commands are covered by tests, and every rule is mutation-checked (deliberately broken,
  with the suite required to fail for that rule's own reason). The real build is then driven
  in a real Obsidian, and the full upload and download round trip is proven against a real
  MinIO instance — the object key is recomputed independently from the bytes and matches,
  the link opens anonymously, the bytes read back are identical, and the rendered
  points at the local copy rather than the remote URL.
  Not verified: iOS has never been run, and Android has not been run on a real device.
  MIT licensed. See the repository README for setup details.