v0.4.0

Upgrading from 0.3.0: deploy the web app before telling anyone to update the
plugin; the plugin's session-start key check uses the new GET /api/ingest.
No migrations. Installs pick the plugin up with /plugin update sessclone@sessclone. SESSCLONE_API_KEY is no longer read: enter the key at
the plugin's setup prompt instead.

Added

• The plugin carries its own icon, keywords, and documentation, support,
  privacy and terms links, so Claude's plugin directory shows the SessClone
  mark instead of the publisher's GitHub avatar and links to each page.
• The Collector says, once, which Org it is reporting to when a session
  starts, and says every session that it is not connected while the key is
  missing or refused.
• /sessclone:status shows the deployment, whether the key was accepted at
  session start and for which Org, this Device, and what is waiting to send.
• /sessclone:sync sends everything waiting at the end of that turn instead
  of at the next session start.
• A key the deployment refuses stops the Collector sending until a session
  starts with a key it accepts, instead of resending history every turn.
• GET /api/ingest answers the Org's name for a live key, and the same 401 as
  a report otherwise.
• The plugin has a README saying what it sends, where, and what it runs.

Changed

• The Collector no longer follows a redirect when it reports. A 301 or 302
  would turn the report into the new key check's GET, which answers 200 and
  files nothing, so the Turns would be marked sent and lost.
• The deployment URL defaults to https://sessclone.com, so installing
  against the hosted service asks for the key and nothing else.
• The API key is read only from the plugin's setup prompt, never from
  SESSCLONE_API_KEY in the shell. It may be left empty in a Claude Code
  cloud environment whose SessClone API credential adds it, so the setup
  script no longer carries a placeholder key.
• Every email is restyled in the product's own look.
• Google Search shows the SessClone mark (favicon.ico).
• Sign-in, sign-up, invitation, new-Org and admin pages carry noindex and
  their own titles, and robots.txt no longer blocks sign-in, sign-up and
  invitations, so search engines can read that noindex (a blocked page can
  still be indexed from links). The unused Host: line is gone.
• A signed-out visit to a page that does not exist gets a 404 instead of a
  redirect to sign-in, which search engines read as a soft 404. Only the
  pages behind sign-in (the dashboard, admin, new Org) still redirect there.
• A page that does not exist shows the site's own header and footer, the
  address asked for, and links to the home page, docs, pricing and sign-in,
  instead of Next's bare 404.
• The home page's structured data names an Organization (name, logo, GitHub)
  as the application's publisher, and the docs landing page has its own
  description.