feat: v0.1.0-rc.1 — AI transport hardening + web/Docker production readiness - #62

Release candidate 0.1.0-rc.1

🚀 Features

• Vault Q&A / generation routing — [[wikilink]], questions, and generation verbs on an empty doc answer FROM vault context (no tools, plain-Markdown insert)
• Custom OpenAI-compatible provider via env — DB_OPENAI_COMPAT_BASE_URL/_API_KEY/_MODEL; UI shows read-only ("from env" badge), backward compatible when unset
• Server-side trash (web) — .trash/ persisted in /data, excluded from tree/search/git, sidebar Trash panel with restore/empty
• Clickable [[wikilink]] — accent visual, hover hint, single-click tooltip, Cmd/Ctrl+Click navigation; wikilink search merged into the ⌘K popover (one icon)
• Persistent sessions — sessions.json (SHA-256 hashed) survive restarts
• Optional keys encryption — DB_KEYS_PASSPHRASE → AES-256-GCM at rest

🐛 Bug Fixes

• AI transport: probe per model, ops-only output (no double-write), removed Path A→B retry (text-only no longer pays 2× generation), crypto.randomUUID secure-context fallback
• Web server: test_connection camelCase args (fix 400 + key never used), probe tool_choice:"required" + JSON tools:false contract
• Shortcuts: ⌘⇧F/⌘⇧P no longer hijack search; canonical ⌘⇧F/⌘⌥⇧F + native ⌘N alias

🧪 Testing & CI

• Full e2e suite (npm run test:e2e) — smoke/trash/theme/ai-debug (Path A + B); [chromium, webkit] matrix with PR approval; logs as artifacts
• ACL guard (Tauri command without an allow-* entry fails CI), test-server-linux job (cfg linux paths)

📚 Documentation

• README/SECURITY/CONTRIBUTING: security model, env override, DRY commit convention (subject → changelog line)

🔄 Version

• Bump 0.1.0-rc.1 + CHANGELOG section (7-point version consistency verified)

Tag v0.1.0-rc.1 is cut on master after merge (publish job is tag-only).