v0.13.0

• docs(changelog): roll unreleased entries into 0.13.0 (#332) (bceaa31)
• feat(config): warn when a stdio upstream sets an ignored url (#331) (09e885e)
• fix(dashboard): sever dead /api/events connections at sweep (#330) (4036a32)
• feat(dashboard): session_source filter on the Feed view (#328) (8da3591)
• feat(dashboard): cap concurrent /api/events connections at 256 (#326) (f8af221)
• fix(proxy): name both config forms in the unreachable-upstream hint (#325) (f7ddf81)
• feat(config): make upstream.url optional for stdio transports (#323) (3d4d242)
• docs: multi-upstream reference, migration guide, and example (#318) (04d306a)
• feat(dashboard): render upstream attribution across every surface (#317) (efebe3d)
• test(proxy): add the two-upstream end-to-end isolation and sharing suite (#315) (5da9f89)
• feat(proxy): serve named upstreams at /mcp/ and /sse/ (#314) (180814e)
• feat(proxy): add named multi-upstream configuration, validated and dark (#311) (0cf3df6)
• feat(proxy): add upstream attribution across audit, events, tickets, and ledger reads (#310) (9a33696)
• feat(proxy): add upstream label plumbing and partitioned limiter keys (#309) (6f2d5c2)
• ci(docs): count CHANGELOG.md as documentation in the drift guard (#308) (4c9baef)
• fix(upstream)!: own the accept advertisement on the HTTP upstream legs (#306) (ac62a0e)
• fix(upstream): re-stamp truthful content-type on both forwarders' sends (#305) (d234a60)
• fix(upstream): strip caller-supplied mcp-session-id in streamable sends (#303) (7f85144)
• fix(policy): discriminate rate buckets by owning rule (#301) (eed060c)