NomadPL 0.2.1 — security fixes

This fixes a private-key exposure in the old default setup. The static server now defaults to public/ instead of the current folder, blocks state directories, and refuses configured identity files inside any public static root.

If you ran 0.2.0 with the default paths on a reachable network, treat that identity as potentially exposed. Move private state outside the public folder and generate a new identity. This changes the site address; upgrading cannot revoke a copied key.

Incoming application requests now have concurrency and rate limits. The protocol and destination namespace stay the same.

This is still experimental software. The attached wheel and source archive are version 0.2.1.