v0.21.0: version negotiation, image fidelity, SSH view niceties

Version negotiation — and the last session-id rotation. Until now, any breaking
change to the push<->hub wire format bumped the session-id salt, which changed
every session id: every such upgrade meant re-running print-id and updating
--allow and view URLs. That is now over. The push client sends the wire protocol
it speaks, and a hub that can't serve it replies with a clear error naming its
exact version and which side to upgrade — instead of a silent stall or a
misleading "unknown key". From here the salt is frozen: future wire changes
negotiate a protocol number, so session ids never move for a protocol change
again.

ACTION REQUIRED, once: v0.21.0 carries the final salt bump (v5 -> v6), so it
rotates session ids this one last time. Re-run print-id --key <secret> and
update the hub's --allow (and any --sessions-file and shared view URLs). Your
secret keys stay valid. A v0.21.0 client against an older hub, or vice versa,
now fails loudly with a version message rather than silently.

Inline images no longer bleed into the line below. A sixel/kitty/iTerm2 image
whose pixel height wasn't an exact multiple of the cell height claimed one extra
full row on the web mirror, so the shell prompt printed on that row drew on top
of the image. Images now occupy their true (fractional) height, matching what
the terminal shows. Producer-side fix — effective once the serve/push side is on
v0.21.0, no viewer change.

SSH view: centering and a MOTD. The read-only SSH view now centers the session
when the viewer's terminal is larger than the operator's, horizontally and/or
vertically, instead of pinning it to the top-left. New --ssh-motd-file <path>
shows a banner when a client connects (any control characters allowed, so ANSI
art works), held for --ssh-motd-delay <n> seconds (default 5).

A one-shot /snapshot endpoint. Each session now serves GET .../snapshot: a
single JSON blob of the current screen — the same full-frame message a new
viewer receives first — without opening an SSE stream. On both serve and hub.

/api/sessions reports activity. The management API's session list now shows
whether each session is live and its viewer counts per transport (web, ssh), so
shellglass sessions list tells you what's actually being watched.

Hub operators: deploy the new hub for negotiation, /snapshot, the activity
listing, and the SSH features; the image fix rides the serve/push binary. Because
of the salt bump, rotate ids as noted above when you upgrade.