v0.3.0

• New wallet protect [id] re-keys a still-shared bearer holding when receive's auto-protect was declined or failed.
• A whole-token bearer transfer now hands back the recipient's token and secret.
• A ledger write that fails after the Hub moved money is reported with a recovery hint (transfer, consolidate, redeem).
• A bearer secret is saved before it's used and retried at spend time, so an interrupted protect can't lose it.
• An ambiguous consolidate delivery is checked against the Hub instead of guessed.
• receive bounds the Hub-reported amount and checks it against the token's signed amount; oversized amounts are rejected.
• Wallet connection values never appear in --json output or as display labels, and secret redaction in errors is stronger.
• pay now confirms and previews the amount before sending.
• decode no longer goes online by default; its --check prompt defaults to no.
• Pasting a Nostr key (npub, nsec, ...) into decode/receive gets a clear message instead of a TLV error.
• wallet balance leaves expired held tokens out of the total (still listed, marked expired) and names unreachable wallets instead of dropping them.
• wallet balance --from on a spent token is not_found, not its old amount.
• Expired-token errors say the token expired, not the wallet; human-mode errors keep the Hub's actual reason.
• Concurrent init and config saves no longer overwrite each other; the losing init reports already_configured.
• A bare cash/wallet/connect/circle or a mistyped subcommand exits 2.
• -c/--connection on commands it can't apply to is a usage error; an explicit 0 amount is a usage error.
• Token IDs match case-insensitively; wallet show works without an identity; init --json never adopts an ncli vault.
• --yes no longer replaces an existing default wallet (connect add, join).
• Prompts, pick-lists and the spinner go to stderr; results stay on stdout.
• Hub/wallet text is sanitized more thoroughly (control and bidi characters), including in list-tx, budget and join.
• Bumped nmilat to v0.3.1.