SubMaker v1.4.6-beta

All sessions and tokens were forcibly invalidated in this update with no backward compatibility/legacy.

• Addon origin checks now accept any *.strem.io host to prevent false security blocks from Stremio edge domains.
• Service worker now treats session/token API calls as non-cacheable and honors server no-store headers before caching API responses to avoid persisting sensitive data.
• Config page caches are now scoped to the active session token so swapping tokens can't leak or reuse another user's saved configuration.
• Session manager fingerprints configs and backfills token metadata, deleting mismatched or corrupted sessions from storage to prevent cross-user contamination.
• Session manager now removes sessions immediately when decryption fails or yields empty configs, ensuring corrupted payloads cannot be reused across users.
• Session-token config resolutions now always bypass the in-process resolve cache, preventing stale token lookups from leaking other users' language/target settings.
• Session-token addon routers are no longer served from the router cache; routers are rebuilt per request to eliminate stale token bleed across users.
• Package version bumped to 1.4.6 so runtime version reporting and cache busting align with the release notes.
• Redis key prefixes are now normalized to a canonical colon-suffixed form while still accepting colon/non-colon/custom variants, preventing mixed-prefix splits like stremiosession:*.
• Redis migrations reuse a raw migration client, handle cross-prefix self-healing across all variants, and clean up duplicates when targets already exist.
• Redis pub/sub invalidation subscribes and publishes on both prefixed and unprefixed channels to keep cache invalidations working across hosts with different prefixes.
• Startup validation now scans for double-prefixed keys across all configured prefix variants to flag misconfigurations early.