AbstractContinuum 0.4.0

Serving Continuum through the gateway at /apps/continuum/ needs
AbstractGateway 0.7.0 or newer. Standalone use on Continuum's own port works
with AbstractGateway 0.4.1 or newer, as before. The server keeps listening on
127.0.0.1 by default.

Added

• Served through the gateway at /apps/continuum/. A gateway that
  manages Continuum opens it on the gateway's own address, so a remote or
  headless machine needs one port and one tunnel for the console and every
  app. Every response announces X-AbstractFramework-App: continuum; mount=1
  (the WebSocket 101 too); the page is served with its <base href> and
  base_path; cookies carry Path=/apps/continuum/. Standalone at / on
  Continuum's own port works as before.
• --gateway and --url are accepted as aliases of --gateway-url, the
  spelling shared by every AbstractFramework app.
• With no flag, setting or environment variable naming a gateway, Continuum
  uses the gateway installed on this computer
  (~/.abstractframework/gateway.json, reported as the gateway installed on
  this computer) and follows it to a new port while running.

Changed

• Every request the page makes is relative to the page (api/gateway/…,
  api/hub/…, api/continuum/settings), and the build uses relative asset
  URLs. npm run build fails on a root-absolute same-origin URL in dist/.
• The Team page's hub proxy, its WebSocket relay and the Settings route judge
  the browser's address as the gateway reports it: opened through the gateway
  from another machine, they refuse the browser unless Continuum runs with
  --hub-allow-remote. The Origin check compares with the host the browser
  addressed. A malformed forwarded header is refused with 400.
• The app document's CSP admits the one configuration script the server
  injects, by its hash.
• A markdown link or image in a hub message that targets a root-absolute
  /api/… address is shown as a blocked link (behind the gateway it would
  reach the gateway's own API); hub attachment images embed through the
  relative api/hub/… address.
• Requires @abstractframework/app-server 0.1.11 or newer (the mount kit)
  and is built against @abstractframework/ui-kit 0.1.14 (joinBaseUrl /
  GATEWAY_CONNECTION_PATH).
• Team AI features read up to 50,000 tokens of the conversation (ADR-0026).
  Summarize and the channel assistant used to send at most 24,000 characters
  of transcript: the oldest messages were dropped and any message longer than
  12,000 characters was cut. The transcript is now the newest whole messages
  up to 50,000 estimated tokens (the same history window as AbstractRuntime),
  and no message is ever cut. The transcript's first line tells the model how
  many messages it holds; when older messages are dropped, a labeled
  #TRUNCATION line gives the count. The summary header and the assistant
  drawer show what the model read, for example
  "38 of 40 messages (2 oldest dropped by the 50,000-token history window)".
• Backlog advisor attachments are sent whole. Attached files were limited
  to the first 6 files and 20,000 characters each. Every picked file is now
  inlined in full into the composer, where you can see it before you send.

Security

• With @abstractframework/app-server 0.1.11 or newer, a request counts as
  coming from this computer only when both its connection address and the
  host name the browser addressed are loopback, so a page served from another
  site under a name that resolves to 127.0.0.1 is treated as remote.