feat: 升级至 v0.3.1 — 全量代码审计修复 + 安全增强

本次升级基于完整代码审查，修复 Critical/High/Medium/Low 四级共 96 项问题，
并通过返工审计修复 10 项遗留问题，tsc 双端类型检查零错误。

Critical (10/10 完成):
- C-4: command.ts 接入 shell-quote 进行 token-level 注入检测，替代原有正则匹配
  可防御 r"m" -rf /、$'rm'、$(echo rm) 等字符串拼接绕过

High (11/11 完成):
- 竞态保护、Promise.allSettled、AbortController 资源泄漏、IPC 参数校验等

Medium (55/55 完成):
- 事务保护、敏感数据脱敏、枚举校验、MUI v9 Stack prop 迁移、
  React 组件 cancelled 标志、类型收窄等

Low (20/20 完成):
- 辅助方法提取（flushToolCallBuffer/scoreAndPushMemory/tryAddColumn 等）
- nanoid 统一替代 Date.now()+Math.random()
- confirm() 替换为 MUI Dialog、useMemo 缓存、魔法数字命名化等

返工审计修复 (10/10 完成):
- L-11: LogsSettings 残留的原生 confirm()/alert() 全部替换为 MUI Dialog/Alert
- M-53: MemoryViewer handleSearch 独立 ref，修复 searching 状态卡死
- M-42: 脱敏短值（length <= 4）泄露修复
- M-47: tasks:update 补全 title/description 类型校验
- L-9: ollama.adapter 非流式路径 nanoid 统一
- M-45: audit:query limit 策略与 memory:listAll 一致化
- SettingsModal handleConfirmRemove 补全 try/catch + loadServers cleanup
- L-15: CommandPalette useMemo 补全 sessions 响应式依赖
- useAgentStream 事件类型补全 seq/timestamp 字段

新增依赖: shell-quote + @types/shell-quote
版本号: 0.3.0 -> 0.3.1

src/App.tsx

@@ -9,6 +9,7 @@
 
 import { ThemeProvider, CssBaseline } from '@mui/material';
 import { useEffect } from 'react';
+import { Header } from '@renderer/components/layout/Header';
 import { Sidebar } from '@renderer/components/layout/Sidebar';
 import { DetailPanel } from '@renderer/components/layout/DetailPanel';
 import { StatusBar } from '@renderer/components/layout/StatusBar';
@@ -43,12 +44,15 @@ export default function App(): React.JSX.Element {
       window.metona.config.get('onboarding.completed').then((v) => {
         if (v === true) useUIStore.getState().setOnboardingCompleted(true);
       }).catch((err) => { console.error('[App]', err); });
-      Promise.all([
+      // M-25 修复: 改用 Promise.allSettled，单个配置读取失败不影响另一个
+      Promise.allSettled([
         window.metona.config.get('llm.provider'),
         window.metona.config.get('llm.model'),
-      ]).then(([provider, model]) => {
-        if (provider || model) useAgentStore.getState().setProvider((provider as string) || '', (model as string) || '');
-      }).catch((err) => { console.error('[App]', err); });
+      ]).then(([providerResult, modelResult]) => {
+        const provider = providerResult.status === 'fulfilled' ? (providerResult.value as string) || '' : '';
+        const model = modelResult.status === 'fulfilled' ? (modelResult.value as string) || '' : '';
+        if (provider || model) useAgentStore.getState().setProvider(provider, model);
+      });
     }
   }, []);
 
@@ -59,6 +63,8 @@ export default function App(): React.JSX.Element {
         className="h-screen w-screen flex flex-col overflow-hidden select-none"
         style={{ background: muiTheme.palette.background.default, color: muiTheme.palette.text.primary }}
       >
+        {/* H-7 修复: 添加 Header Bar — 规范要求布局为 Header (全宽) + [Sidebar|ChatPanel|DetailPanel] + StatusBar */}
+        <Header />
         <div className="flex-1 flex overflow-hidden min-h-0">
           {sidebarVisible && <Sidebar />}
           <ChatPanel />