v0.4.0

Added

• [udp].port_range config option (e.g. port_range = "40000-40100") to bind
  each UDP association's relay socket inside an inclusive port range instead of an
  OS-assigned ephemeral port — useful behind firewalls/NAT that only forward a
  known range. When the range is exhausted, UDP ASSOCIATE returns a general
  failure reply instead of silently dropping the request.

Changed

• UDP ASSOCIATE now binds the relay socket on the TCP control connection's local
  IP and advertises a separate address, decoupling bind from advertise. The former
  top-level public_addr option is renamed to [udp].advertise and is now
  advertise-only (it no longer affects which IP the socket binds), so a server
  behind NAT/Docker can advertise a client-reachable public IP while binding a
  local one. The advertised port is always the real bound port. [udp].advertise
  accepts a bare IP or an ip:port (the port is ignored) and is validated at
  config load — a malformed value now makes the server refuse to start instead of
  being silently ignored at runtime. No backward-compatible alias is kept: a
  top-level public_addr key in an existing config is silently ignored, so
  migrate it to [udp].advertise before upgrading.

Fixed

• install.sh: the generated Docker Compose now mounts a writable tmpfs for
  /run/next-socks5, so the admin/attach socket is no longer silently disabled
  under the unprivileged container user (docker exec ... next-socks5 attach now
  works). The installer also verifies the container/service actually started
  (catching a crash-loop from a port clash) instead of reporting a false success.