v0.1.0

Ship pulse-client crate + full-repo audit

- crates/pulse-client: tracing::Layer with bounded queue, batched ndjson
  worker, flush interval, drop/sent counters; e2e-tested against live server
- WS tail now integration-tested (backfill + live frames + server-side filter)
- agg: metric kind switch mid-window flushes prior window instead of mixing
  accumulators into one row
- hub: pulse_ingest_rejected_total counts requests rejected at saturation
- CI: rustsec/audit-check job (local scan: 0 vulns; paste unmaintained is a
  datafusion-transitive build-time dep, accepted)
- INGEST-API.md conformance notes: warning alias, ts_ms frame field, token charset