v0.2.1 - redesigned web UI, status filtering, hardening

Polish release: redesigned web UI plus fixes.

• Redesigned web UI (Beeper-inspired dark inbox): sidebar with search + All/Unread/Groups filter chips, compact WhatsApp-style bubbles with inline timestamps, refined group receipts and reactions
• Demo mode: open /?demo=1 to preview the full inbox with mock data - no pairing, no token
• Statuses fixed: status@broadcast and broadcast lists no longer appear as conversations, and the autoreply sidecar never drafts or auto-replies to them
• Bug fixes: stale-response race when switching chats/sessions, media blob memory leak, reaction picker event handling
• Hardening: nosniff + Referrer-Policy on all responses, Cache-Control: no-store on API JSON