v0.3.0

Security & Auth Hardening

• Fleet role separation: Fleet API key now returns limited fleet role instead of writer — prevents fleet workers from accessing owner-only operations
• Deploy requires owner: Deploy endpoint elevated from writer to owner permission
• First-run IP restriction: Initial account registration restricted to private/loopback networks
• SSRF fix: api_worker_command now uses validated worker URL helper
• XSS fix: Fleet dashboard uses data attributes + event delegation instead of inline JS interpolation

Compose Generator Fixes

• Interpolation escaping: ${VAR} in volumes/commands escaped as $${VAR} for Docker Compose (handles pre-escaped values correctly)
• Named volume declaration: Generated compose files now declare named volumes at top level
• Required env var validation: Deploy rejects blank/whitespace-only required fields

Documentation

• Fleet docs rewritten to accurately describe REST heartbeat architecture (removed fictional WebSocket/join-token references)
• Service guides aligned with actual auth models (earnfm, repocket, iproyal, presearch)
• Fixed repocket policy contradiction

Tests

• Added TestRequireRole covering fleet escalation boundaries
• Added TestEscapeInterpolation, TestIsNamedVolume, TestNamedVolumeDeclaration
• Updated existing tests for new auth requirements