Prepare v0.7.0: docs refresh + browser-harness consolidation (#134)

* test: consolidate browser tests into the vtbrowser module

Port the one regression guard internal/browsertest had that vtbrowser
lacked — TestBrowser_signalAttrClassStyleApply, the real-browser proof
that Signal.Attr/Class/Style bindings actually apply (the #128
colon-syntax fix) — then delete internal/browsertest wholesale.

internal/browsertest was the older //go:build browser harness, never
wired into CI (no job, script, or Makefile referenced it). vtbrowser is
the CI-run harness (its own module, dedicated Browser Tests job), so the
two were redundant; the only unique coverage is preserved by the port.

* docs: prepare v0.7.0 release

- plugins: document embedded-asset delivery (zero boot-time network I/O,
  content-hashed paths) and the WithCDN(url, integrity)/WithSource opt-outs.
- production: fix the stale single-process-only broadcast claim (Broadcast*
  fans out cross-pod with a backplane since v0.6.1); add the health/readiness
  probes section (/livez /healthz /readyz, WithoutHealthEndpoints); add
  WithMaxSessions and the diagnostic knobs (WithStrictDecode,
  WithVerboseErrors, WithoutDevChecks) to the config list.
- testing: replace the removed internal/browsertest section with the
  CI-wired vtbrowser harness.
- MIGRATION: promote the NumOps Min/Max removal from Unreleased to v0.7.0.

v0.6.0

Features:
- WithRequestTooLarge hook for a friendly oversize-upload 413 response (#107)

Breaking (public API surface trimmed; pre-1.0 minor bump):
- Ctx.Patch encapsulated behind a method: ctx.Patch() (#98)
- on.Option re-exported instead of leaking internal/spec (#99)
- internal-wiring trimmed from the public API surface (#97)

Other:
- avatar/upload cap raised 4 MiB -> 10 MiB (#106); separate WithMaxUploadSize knob
- bundled Datastar client updated to v1.0.2 (#102)
- hardening & adversarial-review passes (#103, #104); docs cohesion pass (#108, #109)

v0.4.2

- feat(maplibre): MapLibre GL plugin — interactive maps driven from Go (#91)
- fix(sse): coalesce an action's patches into one SSE frame (#90)
- feat(examples): redesign counterscope UI with Via branding (#88)
- ci: bump Go toolchain to 1.26.4 (#89)

v0.4.0 — typed reactive API

Breaking

- ctx.W and ctx.R fields replaced by ctx.Writer() and ctx.Request()
  accessors that return nil (with a warn log) when called outside
  action scope, closing the silent-panic path for goroutines that
  outlive an action.

Features
- WithSecureCookies() option: marks the session cookie Secure.
- WithContextTTL(d) option (default 15min): idle Ctx sweep to prevent
  per-tab context leaks when browsers close without firing the
  beforeunload beacon.
- WithSSEHeartbeat(d) option (default 25s): no-op SSE frame that
  keeps the connection alive past reverse-proxy idle timeouts
  (nginx/ALB/Cloudflare defaults ~60s) and surfaces dead sockets.

Reliability
- Per-Ctx session binding: handleAction, handleSSE, and handleSSEClose
  reject requests whose session cookie does not match the session that
  created the Ctx. The via_tab ID continues to act as the anti-CSRF
  nonce; this pairs it with session ownership.
- Coalescing patch queue replaces the 64-slot chan patch. Element
  patches last-wins, signals merge by key, scripts concatenate with
  per-script try/catch wrapping (order preserved, isolated failures),
  redirects preempt other pending patches. Bounded memory, no silent
  drops under burst load.
- Session ID entropy raised from 32 to 256 bits.

Examples
- auth example uses bcrypt instead of storing plaintext passwords.

feat: app-level signals, page-load init, and flash-free picocss theming

- Add AppSignal with exported AppSignalHandle type for app-wide
reactive
    signals with per-tab value isolation; handles resolve by display ID
so
    they work correctly across app instances
  - Move cmp.Init from SSE connect to GET handler (runs before view on
    every page load), enabling signal setup before initial render
  - Picocss plugin registers signals via AppSignal; exposes
package-level
    SetDarkMode/GetDarkMode/SetTheme/GetTheme backed by atomic handles
  - Add blocking script in picocss that resolves dark mode and theme
from
    data-signals synchronously before CSS loads — zero flash
  - Update auth example: layout init sets prefs, profile actions use
    picocss.SetDarkMode/SetTheme, view is read-only

chore: cleanup auth bin from output from build