release: v0.1.0 — one-click install, keyless boot, in-app Provider Settings (#142)

The first formal release.

- One-click install via Pinokio; keyless boot lands on a live Esri World
  Imagery satellite globe with keyless terrain, with automatic OSM fallback
  and graceful degradation when terrain is unavailable.
- Provider Settings (the POWER UP panel): add, replace, or remove API keys
  inside the app; credential files made owner-only before any secret is
  written; external keys shown read-only; the panel refuses shared or proxied
  servers.
- Keyless capability responses for the optional HUD summary and place search.
- Aircraft-identity voice answers cover operator, type, and route, and say so
  plainly when enrichment is unavailable.
- README rewritten keyless-first; concise 0.1.0 changelog section; CI
  workflow included.

Gates: 2,672 unit tests pass / 0 fail, build clean, tracking regression
108/108, map-source tray QA pass, setup doctor ready.

src/keySetup.test.mjs

@@ -0,0 +1,41 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  collectKeyUpdates,
+  keySetupChipLabel,
+  stripKeylessBasemapFromHash,
+} from './keySetup.js';
+
+test('the chip counts what is missing, and retires the count at zero', () => {
+  assert.equal(keySetupChipLabel({ setCount: 0, total: 8 }), 'POWER UP · 8 KEYS WAITING');
+  assert.equal(keySetupChipLabel({ setCount: 7, total: 8 }), 'POWER UP · 1 KEY WAITING');
+  assert.equal(keySetupChipLabel({ setCount: 8, total: 8 }), 'POWERED UP');
+  assert.equal(keySetupChipLabel(null), 'POWERED UP', 'no status is not a broken label');
+});
+
+test('collectKeyUpdates keeps only non-empty trimmed values', () => {
+  const updates = collectKeyUpdates([
+    { envVar: 'OPENAI_API_KEY', value: '  sk-abc  ' },
+    { envVar: 'FIRMS_MAP_KEY', value: '' },
+    { envVar: 'TOMTOM_API_KEY', value: '   ' },
+    { envVar: '', value: 'orphan' },
+    null,
+  ]);
+  assert.deepEqual(updates, { OPENAI_API_KEY: 'sk-abc' });
+  assert.deepEqual(collectKeyUpdates([]), {});
+  assert.deepEqual(collectKeyUpdates(null), {});
+});
+
+test('the first Google key strips ONLY the keyless OSM basemap from the share hash', () => {
+  const stripped = stripKeylessBasemapFromHash('lat=30.2&lon=-97.7&map=osm&style=normal');
+  assert.ok(stripped !== null);
+  const params = new URLSearchParams(stripped);
+  assert.equal(params.get('map'), null, 'osm basemap removed');
+  assert.equal(params.get('lat'), '30.2', 'camera survives');
+  assert.equal(params.get('style'), 'normal', 'style survives');
+  // A stack under any other name was chosen or shared on purpose.
+  assert.equal(stripKeylessBasemapFromHash('map=bing-aerial&lat=1'), null);
+  assert.equal(stripKeylessBasemapFromHash('lat=1&lon=2'), null, 'no stack, nothing to do');
+  assert.equal(stripKeylessBasemapFromHash(''), null);
+  assert.equal(stripKeylessBasemapFromHash(undefined), null);
+});