v0.20.0: iframe-less embedding

Embed a live terminal in another page without an iframe.

now renders three ways, chosen with a mode attribute (or
data-mode on the one-liner script):

• light (default) — renders in the host page's own DOM. No frame to fight a
  strict CSP or to style around; native selection and copy.
• shadow — renders in a shadow root, style-isolated from the host page.
• iframe — the classic sandboxed frame (the previous behavior).

The embedding contract is unchanged: the one-liner

<script src="https://hub/embed.js" data-src="https://hub/s/demo"></script>

and the element still work; only the default
rendering flips to iframe-less.

Sizing. An unstyled light/shadow embed is the terminal's natural size. Give the
element a CSS width and/or height and the terminal scales to fill that box,
letterboxed (aspect preserved) and re-rasterized crisp as it scales — so it
behaves like a normal sized element.

Cross-origin. Same-origin is the easy path: put the hub behind a reverse proxy
on your own domain and point the embed at that path — every asset the viewer
fetches is relative, so nothing is cross-origin and no CORS is needed. For a
genuinely cross-origin iframe-less embed, run serve or hub with
--cors-origin <origin> (repeat for several, or * for any). The iframe mode
needs none.

No protocol version bump — existing clients, hubs and viewers interoperate
unchanged (the one added register field is optional, with a fallback). Hub
operators: the embed changes ship in the viewer.js / embed.js the hub serves
and in two new per-session routes, so deploying this to the hub is what
delivers iframe-less embedding of its sessions.