v1.9.0 - a host you can open, a page that speaks up

The fourth round of consumer requests, answered in code. Two additions, and a
handful of things that were true but had never been written down.

VirtualHost.Access decides how much of a mapped folder other origins in
the same overlay may read: DenyCors (the default, and what every mapping has
always had), Deny, or Allow.

It exists for web fonts. They are fetched in CORS mode by specification, so the
default refuses a face served from another host of yours - the page renders in a
fallback and nothing reports it. The only way out was one host for everything,
which for one mod meant mapping its whole plugin folder, DLL and settings
included, because splitting it would have cost the fonts.

The same trap catches a single-host mod too: a page handed over with LoadHtml
has an opaque origin, so it is cross-origin to every mapped host, including
its only one. Allow is not free - it is the folder answering
Access-Control-Allow-Origin: * to every origin in the overlay - so it belongs
on a folder holding only what the page may read.

Page diagnostics. A new setting, Diagnostics / Log page problems, reports
what a mod's page says went wrong inside itself: a script error, an unhandled
rejection, a console error, or a font that would not load. Nothing in there
reached the log before - the window could be rendering in the wrong font, having
thrown on every frame, and the only report was a player saying it looked wrong.
Off by default and behind Advanced, like its neighbour, and it reaches windows
opened after it is switched on.

Written down at last:

• Channel ordering. Messages arrive at the page in the order they were
  posted, across channels and not merely within one, because every send goes
  through a single queue. Retain replays first; LatestOnly keeps the
  position of the message it replaced. Measured, not assumed.
• The default window geometry - 80% by 85%, centred - is documented on
  Width and Height themselves, where someone deciding not to set a size will
  read it. That is exactly where a first-person game reads the mouse, and it
  cost the 1.8.6-1.8.8 series to find.
• docs/SOFT-DEPENDENCY.md names the pattern three consumers had each
  arrived at independently, and states the half of the rule that is easier to
  miss: a version gate answers whether a member behaves, not whether it
  exists.
• tools/Audit-SoftDependency.ps1 ships here now rather than in a consumer.
  It is the build-time check for that rule, and it gained the missing half.

Also settled: two questions this repository had been carrying as comments -
that the ordering guarantee is what is now promised, and that DENY_CORS rather
than the stricter DENY is the right default, because an inline page really
cannot reach a Deny folder.

Extract over the game root. Everything is additive; nothing a consumer gates on
has moved, so 1.8.8 remains the floor for click-through.