- feat(pki): anchor TLS certs to a fixed directory and give each CA a unique name
- fix(security): add message length cap and several hardening updates
- fix(dev): prevent intermittent CSS load failures on the dev server
- fix(search): suppress false-positive CodeQL SQL-injection alert
- fix: resolve SonarCloud code smells
- docs: add PyPI package and downloads badges; use fully qualified URLs in README
- docs: add SECURITY.md