release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

The first formal release.

- One-click install via Pinokio; keyless boot lands on a live Esri World
  Imagery satellite globe with keyless terrain, with automatic OSM fallback
  and graceful degradation when terrain is unavailable.
- Provider Settings (the POWER UP panel): add, replace, or remove API keys
  inside the app; credential files made owner-only before any secret is
  written; external keys shown read-only; the panel refuses shared or proxied
  servers.
- Keyless capability responses for the optional HUD summary and place search.
- Aircraft-identity voice answers cover operator, type, and route, and say so
  plainly when enrichment is unavailable.
- README rewritten keyless-first; concise 0.1.0 changelog section; CI
  workflow included.

Gates: 2,672 unit tests pass / 0 fail, build clean, tracking regression
108/108, map-source tray QA pass, setup doctor ready.

docs/opensky-auth.md

@@ -14,8 +14,8 @@ Reference: OpenSky REST API docs recommend OAuth2 Client Credentials flow.
 Import credentials from JSON (`clientId`/`clientSecret` or `client_id`/`client_secret`) into Keychain:
 
 ```bash
-./scripts/opensky-import-client.sh /path/to/credentials.json
-# or: npm run opensky:import -- /path/to/credentials.json
+./scripts/opensky-import-client.sh ~/Downloads/credentials.json
+# or: npm run opensky:import -- ~/Downloads/credentials.json
 ```
 
 Then launch:
@@ -32,7 +32,7 @@ Expected startup lines:
 ## Optional: Launch With File (No Keychain Import)
 
 ```bash
-OPENSKY_CREDENTIALS_FILE=/path/to/credentials.json ./scripts/dev-fresh.sh
+OPENSKY_CREDENTIALS_FILE=~/Downloads/credentials.json ./scripts/dev-fresh.sh
 ```
 
 Launchers resolve OAuth creds in this order: