zkAPI client daemon 0.1.3

Version 0.1.3 adds the web app's trusted-station verification fallback to the CLI.

• When the OA verifier is unavailable or refuses approval, only the compiled oa-station signing-key pin can use the fallback. The client verifies its Ed25519 signature over the exact station ID, provider key and expiry locally. Unknown stations still require matching verifier approval.
• Fallback remains unverified. Responses report verifier-unavailable and trusted_station_fallback; the terminal warns that provider ownership and privacy settings were not confirmed.
• Known bans at verification, expired keys and mismatched verifier bindings still block access. Fallback additionally requires a valid station signature. TLS, redirect, cancellation, response-size and lease/cap/origin checks remain enforced.
• A key keeps its acquisition-time verification result for the configured fixed reuse window. The daemon does not poll for new bans or re-verify the key in the background during that window.
• Existing wallet files, configuration and recovery state are preserved. Install the complete matching client/helper bundle; the updated gateway rejects older helpers' less restrictive fallback results. Stop and restart a running daemon to use the new bundle.
• Release CI now runs the native cryptographic, HTTP policy and wallet tests on all four supported OS/architecture targets, alongside the existing Go race tests, installer checks and package validation.

The compiled pin matches the web app. Its initial trust bootstrap is the HTTPS verifier broadcast observed on October 1, 2026; the operator identity was not independently confirmed through another channel. Rotation requires a reviewed client release. Fallback authenticates the pinned station, without confirming org-signature validity, provider ownership or provider privacy settings.