v1.4.0

• Feature: Links can be bound to an existing account (target_user_id) — they open that account instead of creating a throwaway user
• Feature: Each link can carry its own destination (redirect_to) instead of always landing on the dashboard
• Feature: Public API — qentry_create_login_link(), qentry_delete_login_link(), qentry_get_login_link_url()
• Feature: New qentry_login_redirect filter and qentry_login_link_created action
• Security: A bound link never creates a user and never adds a role, whatever the caller passes
• Security: Destinations are confined to this site by wp_validate_redirect(), on creation and on use
• Security: Creation from code is refused over plain HTTP unless QENTRY_ALLOW_HTTP is defined
• Security: Expiry cleanup no longer deletes an account a link was merely bound to
• Fix: The email-verification flow now honours the link's destination instead of forcing the dashboard
• Fix: Direct-login links no longer show a "resend code" button in the logins list