Release 1.3.1

[wolpert]

Cuts the 1.3.1 release of the Java artifacts and the @pk-auth/passkeys-browser npm SDK.

Version bumps

• gradle.properties: 1.3.0-SNAPSHOT → 1.3.1-SNAPSHOT (the published Java version is driven by the v1.3.1 tag at build time)
• clients/passkeys-browser/package.json + package-lock.json: 1.3.0 → 1.3.1
• site/index.html + site/og-image.svg: hardcoded version fallbacks bumped to 1.3.1 (these otherwise auto-sync from Maven Central)

Changelog ([1.3.1])

• Added — Micronaut admin endpoints can now be disabled.
• Fixed — Browser SDK builds under TypeScript 6.0 (ignoreDeprecations: "6.0").
• Security — supply-chain hardening: SHA-pinned GitHub Actions, pinned Gradle distribution + wrapper validation, dependency-review-action PR gate, Dependabot extended to npm with gated auto-merge.
• Changed — Gradle dependency verification was introduced and then removed (rationale documented).
• Dependencies — routine Dependabot bumps.

Verification

• ./gradlew clean build test → BUILD SUCCESSFUL (223 tasks)
• npm SDK gate (prepublishOnly equivalent): tsc --noEmit clean, 43/43 vitest tests pass, tsup ESM/CJS/DTS build OK

After merge: tag v1.3.1 to trigger the Maven Central release, then publish the npm SDK per RELEASE.md.

🤖 Generated with Claude Code