v0.2.0

Highlights since v0.1.0:

Feature:
- --public-base-url: mount the entire surface (REST, Swagger, OpenAPI,
  MCP, SPA) under a path prefix for reverse-proxy deployments that do
  not strip the prefix. Vite base "./" + runtime <base href> +
  __BASE_PATH__ injection let the single-binary SPA adapt at runtime.

Prod-hardening fixes (from the code review):
- /api/health no longer flips ok=false during a long background reindex.
- Stat fan-out is bounded by --search-timeout-secs (HDD-safe).
- reindexing flag is panic-safe via an RAII guard.
- HOME-unset deployments fall back to /var/lib/plocate-server.
- Queue-timeout error reports in-use/max instead of free count.
- plocate/updatedb children run with stdin=null.

Docs:
- README: config + API tables synced, prefix-mounting section with
  nginx and Caddy examples.