v0.2.0

Added

• Deploys record a self-asserted owner (from --username, else the profile).
  Overwriting a site owned by someone else now needs confirmation — the CLI
  prompts, or pass --force / BRISK_FORCE=1. A spoofable label and footgun
  guard, never access control: unowned sites and every other action stay open.
• DEPLOY_HISTORY=on retains every published deploy as an immutable version
  in a new deploys table — version history now, rollback later. Off by
  default: the previous version is deleted after each atomic swap, keeping
  storage bounded.
• A /changelog page rendered from this file and linked from the dashboard
  nav; tag pushes now cut their GitHub release notes from the same
  CHANGELOG.md.
• OpenGraph image and social meta tags, so shared Brisk links unfurl with a
  preview card.
• A room example — a Three.js isometric diorama.

Changed

• Expanded the self-hosting guide with a how-it-works walkthrough, public
  demo mode, and an architecture diagram.
• Bumped wrangler and esbuild, with a pinned undici override.

Fixed

• Security hardening: /auth/cli browser sessions must confirm through a
  CSRF-guarded consent page before a token is minted, API and dashboard
  responses carry nosniff and anti-framing headers, and uploads serve as
  attachments.
• Closed a visitor cache-poisoning hole — static pages resolve the site from
  the host only, never a client header — and an unset AUTH on a public host
  now fails closed instead of serving an open backend.
• Hardened the open-instance guard so only a literal AUTH=none opens a public
  host: AUTH is trimmed, and any other non-google value — a mis-cased
  Google or a misspelled googl — now fails closed with the same 503 as an
  unset AUTH, instead of silently serving an anonymously-writable backend.
• An open (AUTH=none) public instance can no longer ship silently: the
  fail-closed 503 now spells out the secure setup, the worker warns once when
  open on purpose, and brisk deploy warns and confirms before pushing to an
  open host (bypass with --yes / BRISK_YES=1).
• Generated assets (/brisk.js and the /changelog page) are now built
  during wrangler deploy, so they ship with the worker instead of 404ing.
• Dashboard mobile layout: compact site rows, tighter headings, and a header
  that wraps instead of breaking mid-word.