Closes the ematix.dev "What's not shipped" list and flips status to alpha:

- Pluggable secret stores (Vault / AWS Secrets Manager / GCP SM)
- Snowflake / BigQuery / Redshift backends
- Distributed peer auto-detection (dns:// + k8s:// schemes; engine="auto" default)
- Web UI (flow web) — Pipelines overview, Jobs table, live task-DAG, restart/resume/pause
- Σ.F.1 shape-catalog substrate (planner-level autotuning, replaces hand-wired Inject*Rule set)

Headline TPC-H SF=1 (10-trial median, Apple M3 Pro):
- 1.75× faster than DuckDB (was 1.69× at v0.3.0)
- 2.77× faster than Polars (was 2.71×)
- 13.4× faster than single-node PySpark (was 12.9×)
- 19/22 wins outright (was 18/22)

Full notes: CHANGELOG.md [0.4.0].