MinRender v0.5.3

• API hardening— the /api/config endpoints now require the farm token (the old exemption let any LAN host read and rewrite farm settings), auth fails closed when the farm secret can't be read, token comparison is constant-time, and log/output routes reject path-traversal segments.
• Peer endpoint hardening — UDP heartbeats can no longer create peers or change a peer's address; endpoint.json on the farm share is the sole authority, so a spoofed packet can't redirect leader traffic (and the farm secret) to an attacker-chosen host.
• Secret fingerprint — Settings and /api/status now show a short fingerprint of the farm secret, so nodes that disagree about the secret are easy to spot instead of producing a wall of 401s.
• Windows binaries — every shipped executable now embeds full version metadata, reducing Windows Defender false positives on unsigned builds.