v1.1.0-beta.043 - feat(security/metadata): complete credential decrypt-at-use + ComicInfo credit fields
🔓 Credential decrypt-at-use (completes the beta.038 encryption-at-rest)
- download-clients: decrypt DownloadClient pass/apiKey into a local copy before use (addDownload, removeDownload, status sweep) — without this the at-rest encryption leaves clients reading ciphertext
- hosters/index: decrypt HosterAccount password/apiKey in the resolver before per-hoster use
- engine-streaming delegation deliberately not pulled in (Phase 5)
🔑 Auth hardening (beta.039)
- api-auth: OPDS keys honor expiresAt; legacy admin-key compare uses crypto.timingSafeEqual
🏷️ ComicInfo credit fields (beta.037)
- metadata-extractor/writer read+write Colorist/Letterer/CoverArtist/Teams/Locations/SeriesGroup — completes the metadata editor's write-to-file
✅ Verification
- tsc --noEmit clean; vitest 221/221 across 64 files