Release 0.3.0

[FWao]

Cuts 0.3.0. Minor bump: one new, opt-in feature; no breaking changes.

Version bumped in the four canonical places

package.json, pyproject.toml, CITATION.cff (+ date-released), and the APP_VERSION default in core/config.py — the last being what GET /api/v1/status reports and what the footer shows.

Both lockfiles refreshed (they carry the project version), the version line at the top of THIRD_PARTY_NOTICES.md updated, and the DEIDENTIFIER_IMAGE_TAG examples in docs/operations/deployment.md moved to v0.3.0.

Production dependencies did not change in this PR — #30 already regenerated the notices tables — so only that header line moved.

Changelog

[Unreleased] moved into [0.3.0] — 2026-08-20 with its compare link. The single entry is the OIDC sign-in from #29, tightened on the way in.

I also condensed the [0.2.0] section: it ran to 26 lines across three OCR bullets that each repeated the same link to the same docs page, now one bullet at 19 lines. I left [0.1.2], [0.1.1] and [0.1.0] alone — I tried condensing them too, but the rewrites reshuffled wording without meaningfully shortening anything, which is churn on published history for no reader benefit. Happy to take another pass if you disagree.

Verification

Full local gate, all green:

• uv run ruff check backend/ + ruff format --check
• 381 pytest
• npm run check (prettier, eslint, vue-tsc, both i18n checks)
• npm run build
• 12 Playwright e2e
• mkdocs build

Also grepped the tree for stale 0.2.1 references — none left outside CHANGELOG.md history.

The 12 pre-existing Vitest failures in useLocale/settings are unchanged and unrelated (Node's localStorage needs --localstorage-file).