Header-only control token, masked secrets, loopback default (v0.9.9)

Finishes the small items of the security audit in
docs/prs/2026-07-08-PR#000: TODO 3, 4 and 7.

The three mutating endpoints of BuildsApiController no longer accept the
control token as a `token` query parameter — only the X-GitTally-Token
header, which the bundled UI has always used. URLs end up in access logs,
proxy logs, browser history and Referer headers, and the token never
expires, so a historical log capture would yield a valid credential.

`config:print` masks git.token as `***` on both the raw and the --full
path and names the new --show-secrets flag in a leading YAML comment, so
the output stays parseable when piped. The setup script points at
--show-secrets where it used to steer the operator to the plain token.

`server.bindAddress` now defaults to 127.0.0.1: neither the UI nor the
API authenticates read access, so reaching GitTally should require the
host's reverse proxy. Existing .gittally.yml files keep their explicit
value; the managed nginx container needs `0.0.0.0` set deliberately,
which is noted in the release notes, docs/configuration.md and
docs/deployment.md.

Released as v0.9.9, which also carries the previous two commits.

Co-Authored-By: Claude <noreply@anthropic.com>

src/main/resources/templates/releases.html

@@ -7,6 +7,22 @@
     <div th:replace="~{fragments :: nav(${view})}"></div>
     <div class="panel release-notes">
 
+        <h2>v0.9.9 <span class="muted">— 2026-08-11</span></h2>
+        <ul>
+            <li><strong>Changed default:</strong> <code>server.bindAddress</code> is now <code>127.0.0.1</code>
+                instead of <code>0.0.0.0</code>, because neither the UI nor the API authenticates read access.
+                Existing <code>.gittally.yml</code> files keep whatever they set; with the managed nginx
+                container, <code>0.0.0.0</code> has to be set explicitly.</li>
+            <li>The control token is accepted in the <code>X-GitTally-Token</code> header only — the
+                <code>token</code> query parameter is gone, as URLs end up in access logs and browser history.</li>
+            <li><code>config:print</code> masks <code>git.token</code>; <code>--show-secrets</code> prints it.</li>
+            <li>Files holding secrets (the Gitea token written by <code>init</code>, the control token) are
+                created with mode <code>0600</code> right away instead of being <code>chmod</code>-ed afterwards,
+                the control token is compared in constant time, and git calls pass <code>--</code> before
+                branch names.</li>
+            <li>On narrow screens the page title and the repository name are stacked instead of wrapping.</li>
+        </ul>
+
         <h2>v0.9.8 <span class="muted">— 2026-08-10</span></h2>
         <ul>
             <li>The artifact index also links report pages of directories without an <code>index.html</code>.