Cairn v0.3.0 — Remote access

Phase 3 adds a Remote tab so you can reach your local assistant from other devices — and makes the default safer.

New

• Private by default — Open WebUI now publishes on 127.0.0.1, so nothing is reachable off-machine unless you opt in (previously it bound 0.0.0.0).
• Three binding tiers: 🔒 Private (this computer) · 🏠 Local network (your Wi-Fi) · 🌐 Tailscale (your devices anywhere, encrypted).
• Switching tier rebinds the container (data persists) and shows the live connection URL plus a QR code to scan from a remote/companion client.
• Tailscale is detect-and-guide — Cairn reads tailscale status and shows the tailnet address, but never logs you in.
• Reminder to set an Open WebUI password when you move off Private.

Notes

• Pre-release / build from source (see README). No signed binaries yet.
• Verified end-to-end: tier binding controls reachability (LAN reachable on LAN tier, refused on Private).

Apache-2.0.