v0.1.1

- lantern://local/<handle> file-serving route: stream a real file's bytes to the page (grant-checked, handle-scoped) instead of a base64 data URI. - fs.read-dir over the bulk lane: drops the O(n^2) JSON encode, 600-file listing 607ms -> 288ms. - Hardened the lantern:// asset resolver: strip all leading slashes so a crafted path cannot resolve off the asset root (now tested).