Perfuse v0.1.9

Perfuse v0.1.9: Windows fixes, a public test server, and CRD withpa.

Fixed

Windows is now tested on every push: the full test suite on Windows Server and Windows 11 on Arm, plus a real service install. Testing found these bugs:

• FHIR data loss on Windows. Two creates in quick succession could get the same id, and the second overwrote the first. Ids are now random. Files written by the S3, FTP, SFTP, document and CDA senders and by the file poller were named the same way and are fixed too.
• One-time administrator password lost on Windows. A Windows service has no console, so the log and the first administrator's password went nowhere. The new serve -log-file writes both to a file only its owner can read. Under the service manager this defaults to perfuse.log beside the database, and install-service.ps1 uses logs\perfuse.log.
• SMART signing key refused on restart (Windows).
• Windows service install left the data folder readable by every local user. The install now grants access only to SYSTEM, Administrators and the service account.
• Refused or unreachable connections showed as bare errors on Windows. The connection test now explains them.

New

• Public test server: https://test.perfuse.health. It serves FHIR, Da Vinci CRD, DTR and PAS, SMART App Launch and Backend Services, with test data only. Inferno's clients are registered. It is built from deploy/test-instance.
• CRD doc-purpose withpa. A rules file can now send it by setting allow_withpa: true. It is off by default, because the current validator rejects it pending an HL7 correction.
• perfuse fhir convert -report <file> describes how a feed converted using counts and paths only, with no message contents, so a site can share the result.
• Repeatable SMART App Launch STU2.2 Inferno run in conformance/inferno (run.sh smart).

Full detail: docs/verification.md.