docs(usage): document new attrs, boolean attrs, and API behavior ⛵

- Extend Form Elements with required and multiple
- Add Image and Links (anchor) sections (loading, decoding, download)
- Extend tag aliases list and Accessibility (popover, dialog)
- Add event-handler skip note (on* not applied; use addEventListener) in attrs and Security
- Update Attrs and Schema2UIDefault/Export descriptions in API Reference

Author: NeaByteLab

USAGE.md

@@ -80,7 +80,7 @@ render(schema, document.getElementById('app'))
 
 - **`el.root()`** — returns `Definition` with empty `root: []`. **`el.root(n1, n2, ...)`** or **`el.root([n1, n2])`** — returns `Definition` for `create()`.
 - **`el.node(type, propsOrContent?, ...rest)`** — generic factory (e.g. custom elements). Second arg: optional props object, text content, or first child; `rest`: more children or content. Content (string) and children cannot be mixed. Void tags must not have content or children.
-- **Tag aliases** — `el.div`, `el.span`, `el.main`, `el.header`, `el.h1`, `el.a`, `el.table`, `el.img`, `el.template`, etc. (container + void from `Constant.tagAliases`). Container tags accept props, content (string), or children (nodes). Void tags (img, br, input, …) accept props only.
+- **Tag aliases** — `el.div`, `el.span`, `el.main`, `el.header`, `el.h1`, `el.a`, `el.table`, `el.img`, `el.template`, `el.details`, `el.dialog`, `el.figure`, `el.figcaption`, `el.summary`, `el.search`, `el.fieldset`, `el.legend`, `el.select`, `el.option`, `el.optgroup`, `el.textarea`, `el.blockquote`, `el.pre`, `el.dl`, `el.dt`, `el.dd`, `el.datalist`, `el.iframe`, `el.picture`, `el.slot`, `el.address`, `el.caption`, `el.colgroup`, `el.tfoot`, `el.output`, `el.progress`, `el.menu`, `el.meter`, `el.audio`, `el.video`, `el.hgroup`, `el.abbr`, `el.cite`, `el.code`, `el.strong`, `el.em`, `el.mark`, `el.time`, `el.q`, `el.del`, `el.ins`, and the rest from `Constant.tagAliases` (container + void). Container tags accept props, content (string), or children (nodes). Void tags (e.g. `img`, `br`, `input`) accept props only.
 
 ## Node Shape
 
@@ -92,7 +92,7 @@ Each node is an object with:
 | `id`       | `string` | no       | Element `id` attribute.                                                                                                                     |
 | `layout`   | `Layout` | no       | Width, height, position, flex, gap → CSS.                                                                                                   |
 | `style`    | `Style`  | no       | Fill, stroke, font, border → CSS.                                                                                                           |
-| `attrs`    | `Attrs`  | no       | Arbitrary HTML attributes (href, class, etc.).                                                                                              |
+| `attrs`    | `Attrs`  | no       | HTML attributes (href, class, etc.). Keys starting with `on` are not applied; use `addEventListener` after render.                          |
 | `content`  | `string` | no       | Text content for the node.                                                                                                                  |
 | `src`      | `string` | no       | Image (or similar) source URL; use with `type: 'img'`.                                                                                      |
 | `alt`      | `string` | no       | Alt text for img.                                                                                                                           |
@@ -115,25 +115,41 @@ Allowed keys are exactly the above. Extra keys cause validation to throw.
 ## Security
 
 - **Text content** — `content` is applied via `createTextNode()`, so it is safe from HTML injection. Do not interpret `content` as HTML.
-- **Attributes** — `attrs` values are set with `setAttribute()` or property assignment. Do not pass unsanitized user input into `attrs` (e.g. `href`, `src`) without validation or sanitization. For strict policies, consider [Trusted Types](https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API) where supported.
+- **Attributes** — `attrs` values are set with `setAttribute()` or property assignment. Use only attribute names and values from trusted sources, or sanitize them. Do not pass unsanitized user input into `attrs` (e.g. `href`, `src`) without validation or sanitization. For strict policies, consider [Trusted Types](https://developer.mozilla.org/en-US/docs/Web/API/Trusted_Types_API) where supported.
+- **Event handlers** — Attribute keys that start with `on` (e.g. `onclick`, `onerror`) are **skipped** during render and are never set on the element. Use `addEventListener()` on the rendered element instead.
 
 ## Boolean Attributes
 
-These attributes are treated as boolean (MDN: presence = true, absence = false): `checked`, `disabled`, `readonly`, `selected`, `inert`, `hidden`. Use `true` or `false` (or string `'true'`/`'false'`). When the value is false, the attribute is removed from the DOM and the corresponding property is set to false; when true, only the property is set (no attribute string is written). This avoids invalid markup such as `disabled="false"` (which would still disable the element).
+These attributes are treated as boolean (MDN: presence = true, absence = false): `autofocus`, `checked`, `disabled`, `hidden`, `inert`, `multiple`, `open`, `readonly`, `required`, `selected`. Use `true` or `false` (or string `'true'`/`'false'`). When the value is false, the attribute is removed from the DOM and the corresponding property is set to false; when true, only the property is set (no attribute string is written). This avoids invalid markup such as `disabled="false"` (which would still disable the element).
 
 ```typescript
 { type: 'input', attrs: { checked: false } }   // unchecked, no checked attribute
 { type: 'button', attrs: { disabled: true } }  // disabled
 { type: 'div', attrs: { hidden: false } }      // visible, no hidden attribute
+{ type: 'details', attrs: { open: true } }     // disclosure expanded
 ```
 
+- **autofocus** — On `input`, `button`, `select`, and `textarea` the `autofocus` property is set; on other elements the attribute is set/removed. For accessibility, use sparingly: at most one autofocus control per view, and avoid moving focus away from user context (e.g. modals).
+- **open** — On `details` and `dialog` the `open` property is set (disclosure expanded or dialog visible); when false the attribute is removed.
+- **hidden** — For the value `'until-found'`, the attribute is set as-is (see [MDN](https://developer.mozilla.org/en-US/docs/Web/HTML/Global_attributes/hidden)); otherwise treated as boolean (presence = hidden, removed when false).
+
 ## Form Elements
 
 - **disabled** — Applied via property on `input`, `button`, `select`, `textarea`, `fieldset`, `optgroup`, and `option`. Boolean handling as above.
 - **readonly** — Applied via `readOnly` property on `input` and `textarea`.
+- **required** — Applied via `required` property on `input`, `select`, and `textarea`.
+- **multiple** — Applied via `multiple` property on `input` (e.g. file, email) and `select`.
 - **selected** — Applied via `selected` property on `option`.
 - **checked** — Applied via `checked` property on `input` (e.g. checkbox/radio).
 
+## Image
+
+For `type: 'img'`, `node.src` and `node.alt` are set on the element; `attrs.loading` (`'lazy'` or `'eager'`) and `attrs.decoding` (`'sync'`, `'async'`, or `'auto'`) are applied as properties for lazy loading and decode behavior.
+
+## Links (anchor)
+
+For `type: 'a'`, `attrs.download` is applied as the anchor’s `download` property: use `true` for “download with default filename” (empty string) or a string for the suggested filename (e.g. `'report.pdf'`). When `download` is false or omitted, the attribute is removed so the link behaves as a normal navigation link.
+
 ## SVG Attributes
 
 Layout and style from the schema are applied only to HTML elements. For SVG nodes (e.g. `circle`, `rect`, `path` under `svg`), set dimensions and appearance via `attrs` (e.g. `attrs.fill`, `attrs.stroke`, `attrs.width`, `attrs.height`, or `attrs.viewBox` on `svg`). Use `attrs.style` for a CSS string if needed.
@@ -143,6 +159,8 @@ Layout and style from the schema are applied only to HTML elements. For SVG node
 - Prefer **semantic HTML** (`type: 'header'`, `main`, `nav`, `button`, etc.) so built-in roles and behavior are available.
 - **ARIA** — Pass ARIA attributes through `attrs` (e.g. `attrs['aria-label']`, `attrs['aria-live']`, `attrs['aria-hidden']`). For dynamic content that updates without a full re-render, consider `aria-live` regions so assistive technologies can announce changes.
 - **inert** and **hidden** — Supported as boolean attributes (see [Boolean Attributes](#boolean-attributes)) for visibility and focus behavior.
+- **popover** — Use `attrs.popover` with values such as `'auto'`, `'manual'`, or `'hint'` (HTML Popover API). Open/close behavior is controlled by the browser or by your script after render.
+- **dialog** — For `type: 'dialog'`, the element is only created and appended; call `element.showModal()` or `element.close()` after render if you need to open or close it programmatically.
 
 ## API Reference
 
@@ -171,8 +189,9 @@ Types are re-exported under the `Types` namespace: `import type * as Types from
 - **Node:** Object with `type` (string) and optional `id`, `layout`, `style`, `attrs`, `content`, `src`, `alt`, `children` (readonly array of Node). Void tags must not have `children`.
 - **Layout:** Optional `width`, `height`, `x`, `y`, `flex`, `gap` — each `number | string`.
 - **Style:** Optional `border`, `borderRadius`, `boxShadow`, `color`, `fill`, `font`, `margin`, `opacity`, `padding`, `stroke`, `transition` — each `string`.
-- **Attrs:** `Record<string, string | number | boolean>` — HTML attributes. Special handling for `class`/`className`, `style` (string), `value`, and boolean attributes (`checked`, `disabled`, `readonly`, `selected`, `inert`, `hidden`) on the relevant elements.
-- **Schema2UIDefault:** `{ create, render }` — shape returned when calling the default export. **Schema2UIDefaultExport:** callable with `.create`, `.render`, `.el`; calling it returns `Schema2UIDefault & { el: El }`.
+- **Attrs:** `Record<string, string | number | boolean>` — HTML attributes. Keys starting with `on` are skipped (event handlers are not applied). Special handling for `class`/`className`, `style` (string), `value`, boolean attributes (`autofocus`, `checked`, `disabled`, `hidden`, `inert`, `multiple`, `open`, `readonly`, `required`, `selected`), img `loading`/`decoding`, and anchor `download` on the relevant elements.
+- **Schema2UIDefault:** `{ create, render }` — base API shape. Calling the default export returns this plus `el` (i.e. `{ create, render, el }`).
+- **Schema2UIDefaultExport:** the default export (callable); has `.create`, `.render`, `.el`; calling it returns `{ create, render, el }`.
 
 ## Reference