feat: AllowLocalhost default true, exempt dashboard assets from auth

- Default AllowLocalhost to true — dashboard works on localhost without
  --no-auth. Standard dev tool behavior (WireMock, Prometheus, Grafana).
- Exempt dashboard static assets (.js, .css, .html, etc.) from auth so
  the SPA and API key prompt can load even for remote access.
- Update test to explicitly disable localhost bypass.

chore: trigger v0.6.3 release

v0.6.2: Fix 6 security vulnerabilities, rewrite README

- google.golang.org/grpc v1.78.0 → v1.79.3 (critical CVE)
- h3, flatted, devalue updated in docs (5 npm vulns)
- README rewritten for launch: digital twin showcase, MCP section,
  tighter structure with collapsible features

v0.6.1: Fix --stateful flag, JSON schema workspaces, lint fixes

- fix(cli): --stateful with --path now generates table + 5 CRUD mocks
  with statefulBinding (list, create, get, update, delete). Without
  --path, creates bridge-only table as before.
- feat(schema): add workspaces section to JSON schema
- fix: resolve all CI lint issues (race, bodyclose, dupl, unused code)
- fix(ci): update smoke test for tables+extend CRUD flow

v0.6.0: Stateful tables + extend, workspace scoping, digital twins

v0.5.1 — Security patch: Go 1.26.1 (5 CVE fixes), mTLS VerifyConnecti…

…on fix, lint cleanup

v0.5.0: Embedded Web Dashboard + Workspace Routing

Major release:
- Embedded Svelte web dashboard served from admin port (4290)
- Workspace base path routing with namespace isolation
- Route collision detection across workspaces
- gRPC inline proto support
- Stateful chaos faults (circuit breaker, retry-after, progressive degradation)
- Chaos fault introspection API
- Schema-driven response generation from OpenAPI specs
- Multi-engine fan-out (CP/DP Phase 1)
- Headless 'mockd engine' command for CI
- Mockoon environment import
- Seeded reproducible responses
- Template engine unification (MQTT uses core engine)
- 18 MCP tools, 34 faker types, 10 chaos profiles

See CHANGELOG.md for full details.

v0.4.7

Highlights:
- fix: make request template expressions case-insensitive ({{request.Method}}, {{request.method}}, etc. all work now)
- fix: correct WireMock protocol support claims in docs comparison table
- refactor: deduplicate chaos config conversion with canonical converter
- ci: add smoke tests and setup-mockd action compatibility job to CI pipeline
- docs: comprehensive audit — updated 11+ pages, added chaos config reference, fixed examples

v0.4.6 — bug fixes for template engine, chaos API, and Mockoon import

fix: resolve all 24 golangci-lint issues and make scoop upload optional

- errcheck: handle resp.Body.Close() and cmd.Help() return values
- perfsprint: use strconv.Itoa and errors.New where appropriate
- prealloc: preallocate cmdArgs slice with known capacity
- gocyclo: extract matchBodyFields and matchMTLSField from MatchBreakdown
- unparam: use blank identifier for unused handler params (uniform
  MCP handler signature requires args/session/server but not all
  handlers use all three)
- unparam: configureProtocolHandlers returns void (never returned error)
- unparam: getFloat no longer takes unused defaultVal param
- dupl: extract postJSONMap helper from VerifyMock/ExecuteCustomOperation
- goreleaser: skip scoop upload when SCOOP_TAP_TOKEN is not set