chore: release v0.2.0 -- version bump, changelog, FastAPI version fix

CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## v0.2.0 (2026-04-08)
+
+### Features
+- **Federation session deletion** -- kill sessions on remote devices from any muxplex client
+- **Session creation error reporting** -- replaced fire-and-forget subprocess with async process that checks exit codes, surfaces stderr, and pre-flight checks the command binary on PATH
+- **TTY-attach resilience** -- session commands that exit non-zero but still create the tmux session (e.g. `amplifier-workspace` which tries to attach after create) are detected and treated as success
+
+### Bug Fixes
+- **Federation key preservation on URL edit** -- editing a remote instance URL (e.g. `http://` to `https://`) no longer erases the federation key; added position-based fallback alongside the existing URL-based key restoration
+- **PWA manifest auth bypass** -- added `.json` to the static extension allowlist so `/manifest.json` is not auth-gated; previously produced "Syntax error" in the browser console
+- **`auto_open` toggle** -- fixed three-way key mismatch (`auto_open` vs `auto_open_created`) that made the auto-open setting completely non-functional
+- **Session enumeration crash** -- `enumerate_sessions()` now catches `FileNotFoundError` when the session command binary is missing from PATH, preventing poll loop crashes
+- **Settings PATCH key leak** -- the `PATCH /api/settings` response now redacts sensitive keys, matching the existing `GET /api/settings` behavior
+- **Federation 503 diagnostics** -- all federation proxy 503 errors now include the exception type and message instead of just the remote URL
+- **FastAPI version string** -- corrected the hardcoded `version` in the FastAPI app from `0.1.0` to match the release
+
 ## v0.1.1 (2026-04-07)
 
 ### Features