0.2 — security remediation, invite redesign, per-node identity

Everything second-review.md found is closed, bounded, or deferred by an explicit
decision, and the two findings that survived Phase 11.5 are gone:

  H3  the invite path no longer reads a key directory. The node holds the group
      key and wraps it for a key its recipient proves possession of, bound to an
      account by a one-time code the hub never sees.
  M3  node authority comes from a local roster, established by pairing, never
      learned from the hub.
  C4  reduced, not closed: identity keys are per node, so cracking a bundle
      yields the key used with that operator and nothing anywhere else. The KDF
      is Argon2id 128 MB. It closes at 13.3, with the native client.

The claim this release supports: the hub cannot read your content unless it ships
you malicious client code (T3, accepted — see draft-v5 §2, which states every
claim against the adversary it holds against).

Still open and documented as such: T3, chat plaintext at rest until Phase 15,
delegation deferred, and C4 above.

343 tests, plus a full workflow — register, pair, invite, join, download, stream,
second browser, revoke — run against the live deployment.

Tag moved onto the release commit so the packages announce the version the
tag names.