v0.4.0

purple-wolf 0.4.0

Security & robustness hardening on top of v0.3:
- O(1) reputation-limiter eviction (was O(n), a CPU-DoS lever under IP rotation)
- Bounded percent-decode-to-fixpoint (defeats multi-encoding evasion)
- Expanded signature pack (;wget, ${jndi:, php://, /etc/shadow, xp_cmdshell, ...)
- User-Agent SQLi suffix probe (closes the Mozilla-prefix gap)
- NUL-byte / CRLF structural checks
- Over-cap body prefix inspection (closes the padding bypass)
- Panic discipline (panic=abort reality documented + structurally enforced)
- config_fallback audit signal + purple-wolf-validate binary
- Relay SSRF hardening + optional admin bearer auth
- Fuzz targets for XFF parsing and the relay log parser

See CHANGELOG.md for the full list.