v0.10.0

Added

• authorize= predicate on every view + get_urls. All the mounted views
  (DjangoAGUIView, ToolsView, SkillsView, ThreadsView, AttachmentsView,
  TranscribeView) and get_urls now accept an optional
  authorize(request) -> bool predicate, run after the acting user is
  established. A failing predicate denies with 403 (authenticated but
  forbidden) — as distinct from require_authenticated's 401 — returning
  JSON, not an HTML login redirect. This is the seam a staff-gated mount uses
  (authorize=lambda r: r.user.is_staff).
• get_urls forwards the auth seam to every sub-view it builds.
  require_authenticated / get_user / authorize passed to get_urls now
  reach the skills, tools, threads, attachments, and transcribe endpoints, so a
  single call locks the whole mount down (the agent view carries its own auth,
  set when you construct DjangoAGUIView). Defaults stay open.
• DJANGO_AG_UI["ALLOW_ANONYMOUS"] setting (default False) governing how
  the model-backed stores treat anonymous requests — see below.

Security

• Model-backed stores no longer collapse every anonymous visitor into one
  shared owner bucket. Previously an anonymous request resolved to owner id
  None → stored as "", so all anonymous visitors shared one bucket and
  could list / load / rename / delete / download each other's threads and
  attachments. The stores now resolve the owner via resolve_owner_id: an
  authenticated user's pk, or — only when ALLOW_ANONYMOUS=True — a per-browser
  anon:<session_key> bucket. With ALLOW_ANONYMOUS off (the default) an
  anonymous store operation raises AnonymousOperationError, which the
  persistence views turn into 403 and the agent endpoint's save path skips
  (the run still streams; it just isn't persisted). Authenticate the endpoints
  (require_authenticated=True / get_user) whenever a store persists.

Fixed

• get_urls' docstring now documents the threads/<id>/ PATCH rename route
  and the anonymous-scoping caveat.