v0.3.0

Added

• A provider-agnostic platform abstraction (storage, database, rooms, assets,
  cache) behind six seams, so Brisk now runs on Node/self-host — with SQLite
  plus S3 or the filesystem — in addition to Cloudflare, from the same core.
• Self-host packaging under deploy/: a multi-stage Dockerfile that builds and
  runs the Node assembly, a Docker Compose stack (filesystem + SQLite by
  default, optional MinIO for S3), and a Helm chart for Kubernetes.
• npm create brisk — an interactive wizard that scaffolds a self-host
  deployment. Pick a target (Docker Compose, Kubernetes/Helm, or Cloudflare
  Workers), auth mode, and storage backend, and it writes the matching
  deployment config (docker-compose.yml + .env, brisk-values.yaml, or
  .dev.vars + a Cloudflare checklist) plus next steps.
• The dashboard's drag-and-drop deploy takes a "deploying as" name, so a browser
  deploy records an owner the way brisk deploy --username already does. The
  name is remembered between drops. Dropping onto a site someone else owns now
  surfaces the same 409 the CLI does and asks you to launch again to overwrite,
  instead of failing with no way through.

Fixed

• Google sign-in works behind a TLS-terminating reverse proxy. The OAuth
  redirect_uri (and login URLs and the session cookie's Secure flag) were
  derived from the request the app received — plain http when a proxy
  terminates TLS and doesn't forward the scheme — which Google rejects with
  redirect_uri_mismatch. X-Forwarded-Proto is now honored when present, and
  any non-localhost host otherwise resolves as https.
• Deploys are attributed to the asserted deployer, so the dashboard's "by"
  column matches the owner label instead of the authenticated account. On
  AUTH=none every request is the same Dev user, which made every deploy read
  as Dev no matter who shipped it.
• The 404 page tells a missing path apart from a missing site. A typo'd path on
  a live site used to answer with brisk deploy --site <name> — instructions
  that would have overwritten the very site you were browsing. It now links back
  to the site's root, and only an unclaimed name gets the deploy hint.