release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

The first formal release.

- One-click install via Pinokio; keyless boot lands on a live Esri World
  Imagery satellite globe with keyless terrain, with automatic OSM fallback
  and graceful degradation when terrain is unavailable.
- Provider Settings (the POWER UP panel): add, replace, or remove API keys
  inside the app; credential files made owner-only before any secret is
  written; external keys shown read-only; the panel refuses shared or proxied
  servers.
- Keyless capability responses for the optional HUD summary and place search.
- Aircraft-identity voice answers cover operator, type, and route, and say so
  plainly when enrichment is unavailable.
- README rewritten keyless-first; concise 0.1.0 changelog section; CI
  workflow included.

Gates: 2,672 unit tests pass / 0 fail, build clean, tracking regression
108/108, map-source tray QA pass, setup doctor ready.

src/data/contactMatch.js

@@ -92,7 +92,7 @@ export function rankContactMatch({ query, hex = '', callsign = '', registration
  * (`track_entity`) is a MUTATION fulfilling "follow that one" — returning an
  * ambiguity for the caller to resolve would cost a round-trip mid-demo, and
  * the model's observed response to a non-ok track result is to retry with
- * different guesses rather than to ask (field session 2026-08-21,
+ * different guesses rather than to ask (owner field session 2026-08-21,
  * 23:48). So the lookup always commits. What it owes the caller is STABILITY:
  * hex is unique and always present, so the same query resolves to the same
  * contact for as long as both are loaded, instead of flipping between polls