v0.14.0

Removed — the hosted server's code

• osc-bridge mcp --http, --behind-proxy, --data-dir and
  --relay-bind are gone, with the server side of the relay, the ledger of
  accounts and reports, the merge job of agent contributions and the
  container image: the hosted server at mcp.osc-bridge.roomi-fields.com
  is now a separate program built on this crate. osc-bridge mcp is the
  local server on stdio; everything that talks to the hosted server stays
  here (the link of a local copy, osc-bridge connect, the /connect
  page). The relay protocol is documented in src/relay_protocol.rs.

Added — privacy choices, sharing on by default

• A commented settings file, <config>/osc-bridge/settings.toml, created
  at first start and editable by hand: offline = true cuts the link to the
  server, private = [...] lists devices (catalogue id, slug, or vendor/*)
  about which nothing is sent — report_result, report_mapping,
  submit_fix and submit_driver are refused locally, and get_trust is
  answered from the trust fetched at startup. osc-bridge privacy shows the
  settings and changes them (--offline on|off, --private, --public);
  mcp --offline and OSC_BRIDGE_OFFLINE still apply to one run.
• Relay: one device can be kept private — a private box per device on the
  /connect page (remembered by the browser), osc-bridge connect --private-port <name> — and its identity is never recorded; relay_detect
  says so. The share frame gains private: [port names].

Added — every copy linked to the osc-bridge server

• osc-bridge mcp on your machine now stays up to date with what the
  community builds on the hosted server: at startup it mirrors the server's
  catalogue in the background (only the files that changed, into
  <cache>/osc-bridge/catalogue), shows each driver's trust in
  list_devices (usage_status), and offers report_result,
  report_mapping, get_trust, submit_driver, submit_fix and
  get_contribution, run on the server under an anonymous account kept on
  the machine (the one osc-bridge connect uses). MIDI ports never leave
  the machine. --offline or OSC_BRIDGE_OFFLINE=1 cuts the link.
• Hosted server: GET /v1/catalogue (every driver file with its SHA-256)
  and POST /v1/catalogue/files (their contents, 100 per request).

Added — the person at the relay confirms memory writes

• A message sent through the relay that may overwrite the device's memory —
  every SysEx but the Identity Request: patch dumps, stores, settings — goes
  out only once the person at the door accepts it. The /connect page shows
  what the agent wants to send with Accept / Refuse (and an option to
  accept the rest of the session); osc-bridge connect asks in the terminal.
  relay_send waits for the answer (two minutes at most) and reports it;
  gap_ms spaces the messages of a dump. Protocol: confirm,
  confirm_reply, confirm_cancel frames; doors drop any such message that
  comes as a plain midi_out.

Changed — licence

• The code is now AGPL-3.0-or-later (was GPL-3.0-or-later): a modified
  version run as a network service must offer its source to its users. The
  hosted server links its source from GET /. Driver files are unchanged.