v1.10 — Extended protection

• 156 threat vectors mitigated (18 new since v1.0)
• New XS-Leak mitigations: connection coalescing timing,
media query boolean leaks, BroadcastChannel login detection
• Cross-tab correlation guard (visibilitychange jitter + hasFocus spoof)
• Extended FedCM block: credentials.get({identity/silent}) in iframes
• CSS Custom Highlight API, Document PiP and Web Locks now blocked
• Proxy password encrypted with AES-GCM — never stored in plaintext