Security update:

One-time secret retrieval is now protected by a cryptographic proof derived from the random encryption key in the URL fragment. This prevents someone who knows only the secret ID or request path from consuming the secret.

The decryption key remains on the user’s device and is never sent to Secretus secret endpoints. No new permissions were added.

Accessibility and clarity fixes for the sign-in screen.

• The "Continue with Google" and "Sign in" buttons now explain why they are
  unavailable: pressing one without accepting the Terms and Privacy Policy
  highlights the checkbox and moves focus to it, instead of doing nothing.
• Those buttons are now announced by screen readers while unavailable, rather
  than being skipped entirely.
• Fixed a popup sizing issue affecting Chromium-based builds, where the window
  could remain widened after a failed sign-in.

No changes to encryption, permissions, or how secrets are handled.

Fixed a privacy issue: signing out now clears the secret list cached in this
browser. Previously the list — secret IDs and your own labels — stayed on the
device after sign-out and was visible to the next person signing in on the
same browser profile. No secret content or decryption keys were ever stored;
those exist only in the share link. Signing out also clears any unsent draft.