Upgrade Tracebag and demo to .NET 10

[poodlelab]

Problem\n\nTracebag and its demo still targeted .NET 8 even though the repository SDK and supported diagnostic matrix already include .NET 10. This kept the application, demo, framework packages, and published base images on an older release line.\n\n## Design\n\nUpgrade the Tracebag API, bounded demo API, and all referencing test projects to net10.0. Move EF Core and ASP.NET Core testing to 10.0.10 and Npgsql to 10.0.3, update the EF CLI tool, and use digest-pinned .NET 10 SDK and ASP.NET Core images.\n\nThe upgrade also migrates forwarded-header CIDR configuration to the .NET 10 KnownIPNetworks API, selects the .NET 10 runner for the demo, and updates browser, diagnostics, and published-image acceptance paths accordingly. Runtime-specific diagnostic tool-host baselines remain independently pinned because those images serve the dotnet diagnostic tools rather than the Tracebag applications.\n\nRelease metadata and public installation documentation are prepared for v0.1.3.\n\n## Security and compatibility\n\n- Docker privileges or API operations: No new Docker operations, mounts, commands, or browser-controlled inputs.\n- Diagnostic data exposure: No change.\n- Schema/configuration/upgrade impact: No database migration is required. EF reports no pending model changes. Existing Compose configuration remains compatible.\n- Supported runtimes and architectures: Tracebag continues diagnosing .NET 8, 9, and 10 on linux/amd64 and linux/arm64. The Tracebag and demo application images now run on .NET 10.\n\n## Verification\n\n- ./scripts/verify.sh\n- dotnet ef migrations has-pending-model-changes\n- ./scripts/verify-http-postgres-runtime.sh\n- ./scripts/verify-browser-runtime.sh\n- ./scripts/verify-backup-restore-runtime.sh\n- ./scripts/verify-runtime.sh\n- ./scripts/verify-diagnostics-runtime.sh\n- ./scripts/verify-auth-runtime.sh\n- ./scripts/verify-retention-runtime.sh\n\nThe diagnostics suite exercised real .NET 10 process discovery, live counters, persistent recordings, stack snapshots, CPU/threading/contention traces, GC and full dumps, cancellation, timeout, target exit, runner hardening, cleanup, local analysis, and export.\n\n## AI assistance\n\nSelect the level that best describes this change:\n\n- [ ] None beyond incidental completion or spelling assistance.\n- [ ] Assistive: AI helped explore, review, debug, or edit a human-led change.\n- [x] Substantial: AI materially shaped implementation, tests, documentation, or assets.\n\n- Tools used: OpenAI Codex\n- Areas influenced: dependency analysis, implementation, acceptance infrastructure, documentation, release preparation, and verification\n- Human review and verification performed: The maintainer directed the scope and authorized the upgrade and release. The complete diff and executed verification remain subject to maintainer accountability.\n\n- [x] I understand and take responsibility for every change in this pull request.\n\n## Documentation\n\nUpdated the README, demo guide, testing and release documentation, Compose defaults, website quickstart, changelog, and version metadata.\n\n- [x] No secrets or real logs, traces, dumps, or incident bundles are included.\n- [x] Tests cover validation, failure, and cancellation paths where applicable.\n- [x] User-visible behavior and configuration are documented.