Kompl v0.2.0 — multi-provider + visibility + hardening

[tuirk]

Kompl v0.2.0 is out. Three themes:

Multi-provider LLM. DeepSeek V4 Pro is now a second selectable compile/chat backend alongside Gemini 2.5. Per-session model lock means Settings changes don't hot-swap an in-flight compile. DeepSeek handles long/dense sources (academic PDFs, surveys) more reliably — Gemini's structured-output truncation pathology is documented in issue #7 with DeepSeek as the documented workaround.

Compile-pipeline visibility & recovery. Live per-step X/Y progress on the compile UI for extract, draft, match, crossref, commit, and all three ingest steps. Stranded-source recovery — when an extract fails partway through a session, retry now actually re-attempts the source instead of silently no-op'ing. The time-estimate footer shows a range rather than a single pessimistic value. YouTube ingest fully rewritten on top of youtube-transcript-api + YouTube Data API v3 — no more silent chrome-HTML fallback when a video lacks a transcript; those URLs route to Saved Links.

Security pass. SSRF + path-traversal + log-forging hardening; Scorecard-flagged dependencies pinned; the main branch ruleset closes the required-status-checks sub-gap. MCP server picks up GHSA fixes for hono and ip-address.

Also: paste-text connector for raw notes; parallel extract step (concurrency 4); 36h startup hook subsumes the always-on lint cron; deployment-mode toggle removed in favour of single-mode personal-computer.

Migration. migrate.py walks schema v20 → v23 idempotently on boot. New optional YOUTUBE_API_KEY env var; without it, YouTube URLs route to Saved Links.

Full release notes: https://github.com/tuirk/Kompl/releases/tag/v0.2.0
CHANGELOG: https://github.com/tuirk/Kompl/blob/main/CHANGELOG.md