Release 0.4.1

[powerfooI]

Highlights

• Remove the WebSocket browser-origin check from 0.4.0: it rejected legitimate browsers behind reverse proxies that rewrite the Host header, leaving the UI stuck at "Browser disconnected from bridge". Access control is once again the deployment's responsibility (authentication, HTTPS at the proxy, VPN, or firewall), as documented in SECURITY.md.

Verification

• bun run precommit (format, lint, typecheck, 557 tests) green
• All four platform packages built and inspected: checksums verify, VERSION reads herdr-gui 0.4.1 <platform>, executables are 755, --version prints herdr-gui 0.4.1
• Live check: WS upgrade with rewritten Host and public Origin completes with no configuration