Release 1.0.8 with platform, security, and UI hardening.

Adds API filter registry, style theme registry, SW bitmask cache clear, KV namespacing, session expiry checks, accessibility improvements, and expanded test coverage.

Co-authored-by: Cursor <cursoragent@cursor.com>

test/security-policy.test.js

@@ -0,0 +1,19 @@
+import { describe, test } from 'node:test';
+import assert from 'node:assert';
+import { SecurityPolicy } from '../src/security/policy/SecurityPolicy.js';
+
+describe('SecurityPolicy defaults', () => {
+  test('evaluate fails closed when not implemented by a concrete policy', async () => {
+    const policy = new SecurityPolicy();
+    const result = await policy.evaluate('user-1', 'read', '/app');
+    assert.strictEqual(result.allowed, false);
+    assert.strictEqual(result.requires_login, true);
+  });
+
+  test('evaluateSync fails closed when not implemented by a concrete policy', () => {
+    const policy = new SecurityPolicy();
+    const result = policy.evaluateSync('user-1', 'read', '/app');
+    assert.strictEqual(result.allowed, false);
+    assert.strictEqual(result.requires_login, true);
+  });
+});