Ojs

- Bump runtime dependencies and dev tooling (polars 1.42.0, typer 0.26.8, ruff 0.15.20, pyrefly 1.1.1, pytest 9.1.1).
- Pin GitHub Actions to commit SHAs in the publish and test workflows, and drop the redundant github-actions cooldown from the Dependabot config.

- Add `ojs reviews fetch` and `ojs articles fetch`, which log in to the OJS website with `OJS_USERNAME` / `OJS_PASSWORD` and download the instance-specific report CSVs (`OJS_REVIEWS_REPORT_URL` / `OJS_ARTICLES_REPORT_URL`) as `{name}-<YYYYMMDD>.csv` into `OJS_DOWNLOADS_DIR`, so the `fetch` to `norm` handoff needs no manual export; `ojs init` scaffolds the new keys.
- Breaking: drop `OJS_DATA_DIR` (and the `ojs init --data-dir` flag); output directories now split by source into `OJS_DOWNLOADS_DIR` (default `data/ojs-website`, website exports) and `OJS_API_DIR` (default `data/ojs-api`, API data), with the articles and reviews directories defaulting under `OJS_DOWNLOADS_DIR`.
- Bump `idna` to 3.18 to resolve PYSEC-2026-215.

- First public release (history squashed into the initial commit).

- `OJS_DOWNLOADS_DIR` now defaults to `data/ojs-website` (was `$OJS_DATA_DIR/website-downloads`), placing website CSV exports beside the API data rather than nested under it.

- Add a user-level config fallback (`~/.config/ojs/.env` by default, or the file named by `OJS_CONFIG_PATH`) for values not set in the local `.env`; drop the `ojs init --api-key` flag (the key comes only from `OJS_API_KEY` or the hidden prompt).

- Make the CSV export globs fixed package constants (drop the `OJS_ARTICLES_GLOB` / `OJS_REVIEWS_GLOB` env vars); default the data directory to `data/ojs-api` with the API JSON at its root; infer the `submission_files` schema from all rows.