v0.4.0

Added

• SESSION_PORT_BASE — one credential-free SOCKS port per instance, at base+N, for callers that cannot send a username. A browser is the case that forced it: Chrome refuses --proxy-server outright when the URL carries credentials, and Firefox cannot supply them either. Dropping the username instead would fall back to DEFAULT_SESSION and key by client IP, so a browser and the crawler reusing its work would land on two instances and two exit relays — and a clearance replayed from an address that did not earn it reads as the site refusing you. GET /api/sessions/{key} now answers with session_port so a caller is told its port rather than computing one from a setting it cannot see. Requires AUTH_DISABLED and refuses to start without it, since a credential-free port beside listeners that demand a password would undo them silently.