v0.7.0

What's changed

• Rename masking whitelist config to allowlist.
• Replace language detection config with optional phone_regions; phone detection is international-only by default.
• Limit default PII/secrets scanning to input-controlled roles: user, tool, function, and mcp.
• Enable all supported secret detectors by default.
• Tune GLiNER confidence floors to reduce person/location false positives.
• Fix OpenAI streaming unmasking when SSE JSON lines split across chunks.
• Improve Codex role inference and masking for tool, shell, and MCP outputs.
• Track browser-extension requests separately in dashboard stats.
• Redirect / to the dashboard when enabled, otherwise /health.

Verification

• bun test
• bun run typecheck
• bun run check
• GitHub PR checks passed for #118