v0.3.5

Added

• Draft autosave. Page::autosave() writes data.autosave.json without touching index.json, the registry or git. Page::discardAutosave() clears it, and a real save does the same. Page::data() returns the draft to a signed-in session.
• A draft/published toggle for the admin preview (preview-mode/{path}, stored as the preview-published session flag) and a discard route (autosave/discard/{path}) on the admin edit router.
• The Changes page shows a diff per pending page (changes/diff, PageHistory::diffPending()) and has publish-all and discard-all. Publish and discard are grouped, and publish is disabled when there is no draft.
• A password fieldtype. It stores a hash, always decodes blank, and treats a blank submission as "keep the current one". fields/password is its global definition.
• App::roleNames() and phlat user:role <username> <role>.
• stack and blocks fields index their nested field content for search.
• Upload errors (a disallowed type, a failed upload) show in the files tab instead of throwing.

Changed

• phlat/roles/index.json declares only password. The profile field definitions stay available, and a site opts into them.
• User::fields() skips password, which has its own form.
• The admin registry and system views require system.manage through a before() hook, and the users view requires users.manage on GET.
• The branches section and the deploy key on the Changes page require git.manage. The deploy key is behind a disclosure.
• compose.yaml runs the app container as uid/gid 1000.