Fixes the logo, which the previous release made invisible. The mark is parsed
as XML, and without an xmlns declaration every element lands in no namespace at
all, so the browser treats them as unknown tags and paints nothing. Size and
child count stay correct, which is why it went out: the only symptom was a
missing mark in the popup, the settings page and the in-page badge.

Detection is unchanged. Nothing about scanning, redacting or blocking differs
from the previous version.

First update since 0.1.0, and a large one.

Detection went from 41 to 83 detectors: AWS, GitHub, GitLab, Stripe, Slack,
OpenAI, Anthropic, Google, Azure, Twilio, SendGrid, Figma, Atlassian, Terraform
Cloud, Dropbox and more, plus PEM private keys, .env secrets, database
connection strings, JWTs, and personal data like Luhn-valid card numbers, IBANs
and national identifiers. Every match still explains why it was flagged.

Live detection now runs on ChatGPT, Claude, Gemini, Google AI Studio, Microsoft
Copilot, Perplexity and DeepSeek. Composer detection handles shadow-DOM editors
and nested focus, so a site redesign is less likely to break it silently.

Two fixes worth calling out. Overlapping matches used to be resolved by keeping
whichever started first, which could leave the tail of a longer secret visible;
overlaps now cover both spans. And a single malformed pattern in your allowlist
used to throw on every keystroke, which stopped detection entirely; bad patterns
are skipped now.

Block mode also treats a composer too long to scan in full as unresolved rather
than clean, instead of quietly letting it through.

Still zero network requests by default. Nothing is collected, nothing is sent.
The optional local stats endpoint is off unless you turn it on and refuses any
address that is not loopback.