chore: release v0.2.0

[MagicalTux]

🤖 New release

• httpsd: 0.1.1 -> 0.2.0 (⚠ API breaking changes)

⚠ httpsd breaking changes

--- failure constructible_struct_adds_field: externally-constructible struct adds field ---

Description:
A pub struct constructible with a struct literal has a new pub field. Existing struct literals must be updated to include the new field.
        ref: https://doc.rust-lang.org/reference/expressions/struct-expr.html
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.48.0/src/lints/constructible_struct_adds_field.ron

Failed in:
  field AcmeConfig.default_host in /tmp/.tmprexQpZ/httpsd/src/acme/manager.rs:69
  field AcmeConfig.default_host in /tmp/.tmprexQpZ/httpsd/src/acme/manager.rs:69
  field AcmeFileConfig.default_host in /tmp/.tmprexQpZ/httpsd/src/config.rs:104

Changelog

0.2.0 - 2026-07-12

Fixed

• (h3) enforce max field-section size and harden frame-length cast
• (quic) anchor loss-recovery timers to connection construction

Other

• use ? instead of match in find_subslice (newer clippy)
• drop needless borrow in reload test helper
• SIGHUP reloads static certs + works in config mode
• thread ReloadableAcceptor through the static-TLS path
• add ReloadableAcceptor for hot cert reload
• reset accepted sockets to blocking for Windows portability
• signal-driven graceful shutdown + SIGHUP cert reload
• add AcmeManager::reload() to clear cached certs
• Shutdown primitive + graceful drain across runtimes
• expose max_conns_per_ip (F6)
• thread the per-IP limiter through the TCP runtimes (F6)
• add per-IP concurrent-connection limiter (F6)
• close TOCTOU/symlink-escape with race-free confined open
• silence dead_code for still_root_after_drop on non-unix
• harden connection engine against five HTTP/2 DoS findings
• add MIN_PROGRESS slow-trickle floor to serve loop
• fix accept-backoff loop freeze and EINTR shutdown
• verify gid drop and fail when still root [MED]
• route on percent-decoded path, reject encoded separators [HIGH]
• require https:// for the ACME directory URL
• authoritative host validation at ACME entry points
• create key temp file with O_EXCL + target mode (no world-readable race)
• fix percent-decode trailing triplet, canonicalize root once, 404 on symlink escape
• fix three request-parsing security findings
• Stop tracking .claude/ (accidentally committed Claude memory)
• add a default host for SNI-less connections
• parse the leaf cert for expiry, not the whole chain

---

This PR was generated with release-plz.