feat: release Remote Mac KeepAwake v1.4.0

[xudaniel]

Summary

• sign every Mac Pulse heartbeat with HMAC-SHA-256, freshness checks, idempotency, hashed failure throttling, and zero-downtime key rotation
• run autonomous one-minute alert evaluation with a D1 lease, persistent retries, fallback delivery, scheduler canary state, battery-health thresholds, and thermal debounce
• retain read-only battery condition, capacity health, cycle count, thermal state, privacy-safe network fault isolation, exact timestamps, trends, and CSV history
• add checksum-verified release upgrades that atomically upgrade and roll back both installed CLIs
• align version 1.4.0 across both CLIs, dashboard, changelog, bilingual README/PRD/architecture docs, and reviewed bilingual release notes

Local validation

• Bash syntax: passed
• reliability and upgrade suite: passed
• heartbeat signing, rotation, replay, fault-fixture, and permissions suite: passed
• bilingual documentation/release metadata suite: passed
• dashboard lint/build/migrations/routes/signature tests: 17 passed
• npm audit at moderate threshold: 0 vulnerabilities
• real read-only Mac sample: healthy; battery capacity parsing and unsupported thermal-state handling verified
• workflow YAML and diff checks: passed

Tracking

Implements the repository work for #10, #16, #33, #34, and #35. Provider-specific controlled-outage drills, broader hardware/browser matrices, and live deployment configuration remain explicit operational validation rather than being claimed by source-level tests.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 84d49d766e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Enforce the authentication failure limit

Once a source reaches 30 failures, failureLimited only suppresses further writes to auth_failures; no branch rejects or delays requests because the limit was reached. An attacker can therefore continue making unlimited malformed or incorrect-signature requests, each still performing a D1 read and potentially HMAC work, so the newly advertised authentication rate limiting does not actually throttle abuse.

Useful? React with 👍 / 👎.