Replicant v0.5.1

A security and correctness release. It closes everything actionable from two independent
reviews, plus three defects that surfaced during a live LogRhythm lab session and that
neither review found.

Upgrade from v0.5.0. That release is affected by every item under Security below.

Security

• Cross-site WebSocket hijack of the embedded terminal (F-01). Origin validation compared
  hostnames and ignored scheme and port, so any other development server on an analyst's laptop
  could drive the PTY using the ambient session cookie. An origin is now the (scheme, host, port)
  triple, required on every handshake.
• The session cookie was the master token (F-04). It held the persistent launch token from
  ~/.config/replicant/web-token verbatim: no expiry, no rotation, no way to revoke one browser
  without regenerating the token file and breaking every other client. The cookie now carries a
  short-lived random session id. The token is also gone from EventSource and WebSocket query
  strings, where URLs reach server logs, browser history and Referer.
• A terminal child could hang the whole server (F-05). Termination blocked on waitpid on the
  asyncio event loop, so a child ignoring SIGTERM froze every request the server was serving.
  Now non-blocking with SIGKILL escalation, and terminal sessions are capped.
• Failed runs wrote no manifest (F-02).
• Markdown in the Docs tab could execute same-origin code (F-03), plus a javascript: link
  hole found while fixing it. A CSP is now sent as defence in depth.
• --no-auth opened HTTP but rejected every terminal session (F-06).
• Web file output could truncate arbitrary paths (F-07).
• Malformed durations were accepted silently (F-09): -1h parsed as a positive hour.

The telemetry was wrong on two of three vendors

Check Point hardcoded act=Reject / auth_status=Failed Login, and Palo Alto hardcoded
PanOSEventID=auth-fail, on the event:system login path. The engine only ever sends
status=success there, so every administrative login in REP-018 was self-contradictory, wrong
in exactly the field a correlation rule matches, on the technique whose whole premise is
successful logins moving host to host. FortiGate was always correct.

Runs that looked like they were working

• A configured collector did not mean send. The web form's destination switch defaulted off, so
  a verified collector plus a technique plus the run button rendered every event and delivered
  none, while the stream, the progress and the eps readout all looked identical to a working run.
  Measured after the fix: CLI 200 datagrams, web 200 datagrams, identical parameters.
• The single-run lock was invisible. A page reload showed an idle form while the server was
  hours into a run, and the button then failed with a 409 naming a run the operator could not see
  or stop. GET /api/runs/active reports it, and the form offers to stop it by name.
• Send test log said verified against a collector that could not receive anything, because
  it was set from a UDP sendto succeeding, which only proves a route exists. The word is gone
  from the codebase. What replaced it is disclosure: the connect test reports what it proved and
  what it did not, and shows the source address beside the destination, because that is what makes
  a mistyped address visible.
• A refused collector produced a traceback, not a message. The connect timeout also governed
  every later send.

Added

• Every use case states its core objective, shown first in the web UI. The panel used to open
  with "emits synthetic X telemetry that exercises Y", true of all 24 entries and so answering
  nothing.
• IPv6 collectors (F-10).
• Self-describing manifests: vendor, duration, rate, send_stats.

Known limitations

• F-08 is open. The events-per-second cap is per process, so several processes can multiply it
  against one collector. Terminal session caps bound it; the remedy is undecided.
• F-14 is partial. Production dependencies audit clean; the remaining advisories are
  development-only and their fixes require dropping Node 18.
• Palo Alto and Check Point vendor fidelity remains [Unverified] against real appliances.

Full detail in CHANGELOG.md.
The attached wheel was built from a clean checkout of this tag and smoke-tested outside the
repository.