v1.0.2 — Avatar Fixes & Security Hardening

Fixed

• Restored avatar loading — the 118-image avatar picker grid was firing too many concurrent requests to DiceBear, triggering their rate limit (HTTP 429) and blank avatars. Grid images are now deprioritized so avatars render reliably.
• Closed 7 high-severity security advisories — upgraded next and eslint-config-next to 16.3.0, clearing SSRF, middleware-bypass, and server-action DoS advisories plus the inherited sharp/libvips CVEs.
• Stale PWA cache — bumped the service worker cache version so returning users get fresh HTML and hydrated chunks instead of a dead cached shell.
• Landing page polish — tiled the feature grid cleanly, removed dead py-0.2 utility classes, gated looping animations behind prefers-reduced-motion, and dropped misleading cursor-pointer on non-interactive hero elements.

Verified

• bun audit --audit-level high: clean
• bun run typecheck, bun run lint, bun run build: all pass
• /, /lobby, /space/[name]: no console errors, no overflow, correct landmarks