v0.3.4

v0.3.4 collects the security and dashboard work from the audits, plus four
fixes found by driving the built product in a real browser.

The login page could not load its own script. The dashboard's session gate
redirected every sessionless request to /login, and the hashed bundles under
/_astro/* were not exempt — so a logged-out browser got the HTML shell back
where a module script belonged. The browser's strict MIME check rejected it, the
Astro island never hydrated, and /login rendered blank with no password field.
Build output carries no user data, so gating it bought no privacy and cost a
working login form. The loopback/tunnel restriction still applies.

Six endpoints were unreachable from the browser. The dashboard's shared
client sends no Authorization header — its only credential is the session
cookie — but several handlers read a Bearer key out of the headers. mitm-config
sits in the shared layout, so its 401 fired on all 24 dashboard routes; the
console-log page and the TTS voice pickers were affected the same way. These now
use the same tier as the rest of the admin surface, which accepts a session or a
management key. A request with no credential at all is still refused.

Disabled models came back enabled after every restart. AppDb.extra holds
{provider: [model]}, SQLite stores a flat (provider, model) pairs table, and
the load path reassembled that table into an array the readers could not
deserialize — so they fell back to an empty set, silently. The rows were never
lost, only unread: v0.3.4 recovers the disabled models anyone had already
switched off.

An unknown OAuth provider returned 500 instead of 400. Every sibling OAuth
endpoint already answered 400 for a bad provider name.

Earlier in the range:

• Security. Owner-only permissions on the secret files, one SSE terminator
  rule so an OpenAI-to-OpenAI stream no longer ships two [DONE]s, and the
  in-flight budget slot is now held for the body's life rather than released at
  headers — closing a cache-budget bypass.
• Provider parity. The full 9router noAuth probe table, the five plain
  bearer probes, the Aliyun probe URLs, and codex_cli_rs as the codex
  validation target.
• Xiaomi MiMo. The account-service handshake and ECDH sign-in, ported end
  to end.
• Errors. reqwest internals no longer leak into client-visible bodies.
• Agent skills. The 12 missing skills shipped, and the media-provider edit
  was fixed.

Each of the four headline fixes ships with a regression test that fails without
it. The full list is in the commit log between v0.3.3 and this tag.