Add custom key combinations

[enuzzo]

What changed

• adds up to 20 data-only custom keyboard combinations, each with its own name, 2–64 key sequence, enabled state, and same-origin destination
• adds schema version 2 with normalization on every read/save, deterministic IDs, legacy option migration, and a documented 0.1 rollback bridge
• routes built-in presets independently and keeps the legacy browser event alias
• adds an accessible sequence recorder and a responsive WordPress-native settings surface
• updates the plugin to 0.2.0 with synchronized metadata, changelog, ADR, release notes, gotchas, and security assessment
• adds generated design direction and desktop/mobile implementation evidence

Security

• no executable custom callbacks or remote code
• same-origin HTTP(S) destinations are enforced in PHP and revalidated in the browser
• route, token, label, URL, timeout, and payload counts are bounded
• duplicate, prefix, and suffix conflicts fail closed
• the detector remains disabled when no complete route is active and ignores typing/editing contexts
• Codex Security diff scan: complete coverage, 0 reportable findings

Verification

• npm test
• ./scripts/build-release.sh
• unzip -t build/sesamo.zip
• (cd build && shasum -a 256 -c sesamo.zip.sha256)
• in-app browser QA at desktop, 600 px, and 320 px with no horizontal overflow

Real WordPress integration, Plugin Check, assistive-technology smoke testing, and the compatibility matrix remain explicit gates before a public 1.0.0 release.