Harden ReRouted for 0.4.2 launch

[gitcommit90]

What changed

• harden OAuth callback state/path validation, renderer sandboxing, IPC lock enforcement, and diagnostic redaction
• migrate usage history from capped JSON to uncapped SQLite with lossless one-time migration and recovery handling
• refresh provider quota on entry and every 60 seconds while the Quota page remains open
• finish provider connection/cancel flows, account identity labeling, launch copy, and personal-project attribution
• add privacy, security, contribution, issue, pull-request, and CI documentation
• isolate the live landing server from dirty worktrees through SITE_ROOT

Verification

• npm test — 167/167 passing
• Node 22.13 focused SQLite/quota/single-instance suite — 14/14 passing
• npm audit — 0 vulnerabilities
• git diff --check and syntax checks — passing
• deterministic Electron UI capture harness — passing
• Electron runtime /health, authenticated /v1/models, SQLite permissions, and two-process single-instance smoke — passing

Release

This branch sets version 0.4.2. The signed, notarized Apple Silicon DMG and updater ZIP will be built from the exact merged main commit.

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.