v0.4.0

• Add an optional bounded full-duplex session channel carrying Provider-defined JSON in both directions, with no envelope, request ids, or retained history
• Add UiPage and a page feature so turning a frontend's files into a checked page is one assembly rather than one per Provider
• Collapse window, link and session delivery into one call with an environment default, and offer link only when a Provider declares its expiry
• Reserve the __afui/ prefix and let any delivery be ended through __afui/end, including a served page that nobody is attending
• Make the served session list a replaceable frontend whose every card action reports pending, done, or failed