v0.4.7

Changes

• Require generated join passwords for short-code invite claims.
• Add controli join --password support and accept join flags before or after the invite code.
• Update the hosted browser join page to require the join password.
• Hide join password hashes from successful short-code claim responses.
• Warn hosts that relay fallback uses Cloudflare Durable Objects duration for live terminal traffic.
• Fix short invite KV expiry handling for near-60-second invites.

Verification

• CGO_ENABLED=0 go test ./...
• npm run typecheck in infra/cloudflare-relay
• npm run docs:build
• make build