v1.0.0 — production-grade, security-hardened POS

First tagged release. A layered, security-first Java Swing point-of-sale: salted PBKDF2 credentials, masked card/bank data, lossless validated CSV persistence, a JUnit 5 suite with a JaCoCo coverage gate, Spotless + SpotBugs/find-sec-bugs, and a CodeQL/Semgrep/Trivy/gitleaks/OWASP security pipeline (zero findings). See CHANGELOG.md for details.