P3: Release — tag next v0.2.x after HTTP hardening + FastAPI entrypoint

[heidi-dang]

After P0/P1 issues are done (localhost-only bind + FastAPI entrypoint + firewall status), consider tagging next v0.2.x.

Acceptance:

• Changelog entry
• CI green
• Smoke commands documented
• Confirm security invariants preserved.