Harden PSD isolation, releases, CI, and batch memory

[SLP-DEV1]

Summary

Hardens OpenMockup Studio across the security, release, CI, browser-testing, and large-batch paths identified in the repository audit.

Security / privacy

• tunnel only a dedicated temporary design-asset server instead of the Vite application server
• keep the UI on localhost
• protect localhost asset uploads with a random per-run token
• limit the isolated server to temporary image assets with size/TTL bounds

Release integrity

• require release/vX.Y.Z to point at the exact current main commit
• create release tags against the verified SHA
• pin the bundled cloudflared version and verify its SHA-256 before packaging

CI / regression coverage

• Linux Node 20.19 and 22.19 checks
• Windows Node 22.19 check
• real Chromium smoke covering file selection, preview, preset download, and ZIP export
• isolated asset-server regression tests

Performance

• stream ZIP generation
• retain at most 12 batch preview blobs after archive creation and release the rest

Docs

• align README/privacy/architecture/release docs with the isolated tunnel design
• document recommended GitHub repository rules separately because branch rules are repository-admin settings

The existing Dependabot update from #29 is already merged into the base branch.