chore: release v0.3.1

[lostmygithubaccount]

Patch release — 12 merged PRs since v0.3.0 (2026-04-05, PR #21). Hardening-heavy: SQL parsing + injection + XSS + sanitization, plus concurrency tests. No API changes → patch level.

Merged since v0.3.0

Security + hardening:

• fix(ui): security hardening — SQL injection, XSS, input validation #24 fix(ui): security hardening — SQL injection, XSS, input validation
• fix(core): harden extract_table_name parsing #28 fix(core): harden extract_table_name for schema-qualified, quoted, and subquery patterns
• fix(server): sanitize API error responses #29 fix(server): sanitize API error responses to not leak internal details
• fix(catalog): harden DDL table name extraction #30 fix(catalog): harden extract_ddl_table_name for quoted and schema-qualified names
• fix(ui): replace header parse().unwrap() with from_static() #33 fix(ui): replace header parse().unwrap() with from_static()

Concurrency + catalog correctness:

• fix(catalog): consistent case handling and lock release during DDL refresh #26 fix(catalog): consistent case handling and lock release during DDL refresh
• test: add case sensitivity and concurrent DDL+read tests #27 test: add case sensitivity and concurrent DDL+read tests

UI polish:

• feat(ui): polish web UI — numeric alignment, row counts, empty state #23 feat(ui): polish web UI — numeric alignment, row counts, empty state

CLI:

• fix(cli): add --version flag #31 fix(cli): add --version flag and improve description

Scripts + build:

• fix(scripts): add dkdc-db-bench to bump-version #32 fix(scripts): add dkdc-db-bench to bump-version

Refactor:

• refactor(core): extract magic strings to named constants #22 refactor(core): extract magic strings to named constants
• refactor: extract helpers, constants, and idiomatic patterns #25 refactor: extract helpers, constants, and idiomatic patterns

Why patch

All changes are bug fixes, security hardening, tests, or non-breaking refactors. The UI polish (#23) and --version flag (#31) are additive. No removed/renamed public APIs.

Gate

./bin/check green (rust + python).

DO NOT MERGE — agent0 drives merges + tags + publish.

🤖 Generated with Claude Code