feat: audit hardening, webhook retry, and local Claude session tracking (#68)

feat: v1.2.0 — validation hardening, unit tests, quality improvements

chore: CODE_OF_CONDUCT, issue templates, DELETE patterns, limit caps, CSRF origin check

fix: add auth checks on all GET endpoints, timing-safe comparisons, and XSS sanitization

feat: initial open-source release