feat!: genesis-pinned operator set, server identity with an encrypted control link, key-less join codes; release key continuity

Join codes need no passkey touch and carry only public values (genesis
fingerprint, owner credentials, installer hashes). Nodes pin the genesis and
owners at enrollment and only follow passkey-signed operator set versions.
The panel's server key is listed in the set; pinned nodes require its
signature and run the control link under AES-256-GCM. Password sessions carry
no capabilities. The updater adopts a next_key from a signed manifest.

Bump version to 0.2.0. [CI SKIP]

web/shared/theme/base.css

@@ -478,6 +478,67 @@ textarea {
   margin-bottom: 16px;
 }
 
+/* 宽对话框：标题和按钮固定，中间滚动（内容很长的表单，比如选能力） */
+.dialog.wide {
+  width: min(980px, 100%);
+  display: flex;
+  flex-direction: column;
+  overflow: hidden;
+}
+
+.dialog.wide .dialog-body {
+  flex: 1;
+  min-height: 0;
+  overflow: auto;
+  margin: 0 -8px;
+  padding: 0 8px;
+}
+
+.dialog.wide .actions {
+  margin-top: 16px;
+}
+
+/* 能力选择器：工具栏吸顶，分组排成多列，每项两行（名称，代码和说明） */
+.cap-toolbar {
+  position: sticky;
+  top: 0;
+  z-index: 2;
+  background: var(--app-card);
+  padding-bottom: 10px;
+}
+
+.cap-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fill, minmax(300px, 1fr));
+  gap: 12px;
+  align-items: start;
+}
+
+.cap-group {
+  border: 1px solid var(--app-outline-soft);
+  border-radius: 16px;
+  padding: 12px 14px;
+}
+
+.cap-row {
+  padding: 5px 0 5px 22px;
+  border-top: 1px solid var(--app-outline-soft);
+}
+
+.cap-row:first-of-type {
+  border-top: 0;
+}
+
+.cap-meta {
+  margin: 1px 0 0 26px;
+  font-size: 12px;
+  line-height: 1.45;
+}
+
+.cap-meta .mono {
+  margin-right: 6px;
+}
+
 .dialog .actions {
   display: flex;
   justify-content: flex-end;