Align Reader's public-source status and dialog accessibility

[NouraldinFarge]

Summary

• record the verified private vulnerability-reporting, secret-scanning, push-protection, and Dependabot security controls
• add the repository quality badge and reconcile roadmap/release documentation with the current public-source alpha state
• correct generated release-candidate wording so a local unsigned binary candidate is not mislabeled as a private repository
• fix a real settings-dialog contrast defect exposed by hosted axe testing: the entry transition now animates position/scale without fading the entire dialog through sub-threshold contrast
• keep signing, clean-Windows, packaged-app, accessibility-manual, and exact binary-release approval gates explicit

Validation

• Prettier and Rust formatting checks — passed
• JavaScript, CSS, and Markdown lint — passed
• facts, links, and public-tree privacy scans — passed
• 40/40 unit tests — passed
• local Playwright/axe suite — 7/7 browser cases passed with zero serious/critical findings
• git diff --check — passed

Hosted failure and correction

The first hosted run caught three transient color-contrast failures while the 180 ms whole-dialog opacity animation was active (ratios 4.24:1 and 3.95:1 versus the required 4.5:1). The focused fix removes opacity from dialog-in while retaining its transform motion. This addresses the rendered state instead of delaying or weakening the accessibility test.

Release boundary

This remains a public-source alpha and unsigned local binary candidate. It does not create a tag, GitHub Release, public installer download, signing claim, clean-Windows claim, or professional-profile approval.