chore: bump version to 1.13.1

[av1155]

Summary

Promotes the accumulated ## [Unreleased] block to ## [1.13.1] - 2026-08-03
and reseeds an empty Unreleased above it. Patch rather than minor: the block
holds only ### Security entries, with no Added, Changed, or Fixed.

Worth stating the reason for releasing now, since neither finding is exploitable
in Houndarr. docker.yml publishes to GHCR only on a v* tag, so
ghcr.io/av1155/houndarr:latest still ships the 1.13.0 image carrying
cryptography 49.0.0 and pip's vendored packages. Both entries exist to tell an
operator that their scanner alerts are cleared in a given version, and that is
only true once the version exists. The Helm chart publishes on tag too.

Closes #713

Changes

• VERSION: 1.13.0 to 1.13.1
• CHANGELOG.md: Unreleased promoted, fresh empty Unreleased reseeded

Nothing else. No source, dependency, or workflow changes ride along.

Testing

Both bullets were verified against source before promotion rather than taken on
trust, since a versioned block is permanent once released:

Claim	Evidence
cryptography at 50.0.0	pyproject.toml:34, uv.lock:390
linked only through Fernet	src/houndarr/crypto.py:10 is the sole import in src/
pip and uv uninstalled	Dockerfile:77
GHSA-g6cj-pr64-35w5	cryptography, HIGH, PKCS#7 EnvelopedData Bleichenbacher
GHSA-6v7p-g79w-8964	msgpack, HIGH
CVE-2025-47273	setuptools, HIGH

Structure checked against everything version-check.yml enforces: VERSION
matches X.Y.Z, ## [Unreleased] is the topmost ## [...] block and is empty,
a ## [1.13.1] - 2026-08-03 block exists with an allowed ### Security header,
and both blocks carry their trailing ---.

Gates:

ruff check         All checks passed!
ruff format        263 files already formatted
mypy src/          Success: no issues found in 93 source files
bandit             High: 0  Medium: 0  Low: 0

Type of Change

• Bug fix (fix:)
• New feature (feat:)
• Refactoring (refactor:)
• Documentation (docs:)
• CI/CD (ci:)
• Chore (chore:)

Checklist

• Issue exists and is linked above with Closes #N
• Linked issue has exactly one type:* and one priority:* label
• Linked issue has at most one phase:* label (or none when not roadmap work)
• Branch name matches issue scope (feat/<slug>, fix/<slug>, etc.)
• Tests added/updated for all changes (N/A: version bump only)
• Type check passes (mypy src/)
• Lint passes (ruff check .)
• Format passes (ruff format --check .)
• Documentation updated (if applicable)
• No secrets or sensitive data committed
• Scope check: This change helps search for missing or cutoff-unmet media in a controlled way