v0.1.0 — Social SSO

Initial release. Six OAuth2 providers (Google, GitHub, Microsoft, Discord, Facebook, LinkedIn) with HMAC-signed state cookie + PKCE. Security review applied before ship — see CHANGELOG.