v0.2.0 — Go installer + password-mode auth

Highlights:
- Go installer (Cobra + Bubble Tea TUI) replaces the Node CLI
- Single-user password auth mode (AUTH_MODE=password)
- Capability endpoint at / for client-side discovery
- OSS/hosted entrypoint split (src/hosted/)
- Release tracks: stable (this tag) and latest (main branch)