0.10.9 — security hardening (audit #931)

Security-hardening release resolving the seven findings filed against v0.10.8 in FuRongJun-1999/dsh-bounty#931.

Fixed

#	Severity	Fix
1	B	Chat routes (/bridge-chat, /state, /send) now require an allowlisted Host (loopback or trustedHosts); /state is gated like /send; an Origin must still match. DNS-rebinding shape closed.
2	C	Inbound turns are keyed by the handshake-authenticated peer id, never the self-reported origin; local-dialog reserved; per-peer entries bounded (maxPeerSessions, LRU).
3	C	tools.allow/tools.deny are enforced by a live tools.guard name fence; bridge-boot.json reports nameFenceRegistered instead of a computed-but-unused filter.
4	C	hello.nodeId must match the handshake identity; conflicting live names are refused.
5	D	Transcript entries clamped (64 KB default); persistence compacts by bytes as well as line count.
6	D	Listener admission limits (maxConnections, maxConcurrentPerIp) with source-address logging.
7	D	Hop documented as cooperative; duplicate-turn guard (duplicateTurnWindowMs) backs it up.

New config keys: trustedHosts, maxPeerSessions, maxConnections, maxConcurrentPerIp, duplicateTurnWindowMs, transcriptMaxEntryBytes, transcriptMaxFileBytes.

Suite: 217 tests passing. Both ends of the live deployment verified on 0.10.9 (link, duplicate-turn refusal, dialogue, Chinese replies).