feat: release v1.0.2 LeKiwi 语言控制与网站嵌入

集成服务器托管模型、自然语言移动与有界抓放、内置 LeKiwi URL 导入和双摄像头；同步部署契约与指定域名 iframe 白名单，保留原有物理安全、会话及调用预算防护。

更新 npm 包及锁文件版本、CHANGELOG 与发布文档。提交前 typecheck、120 项定向前端测试和 44 项后端测试通过（3 项可选跳过）；真实 v2 云模型抓放仍待单独验收，不包含运行密钥或构建产物。

decision_server/web_sessions.py

@@ -1,4 +1,4 @@
-"""Bounded anonymous sessions; no credentials or session metadata on disk."""
+"""Bounded anonymous sessions; per-visitor state stays in memory."""
 
 import asyncio
 import secrets
@@ -32,6 +32,7 @@ class Visitor:
     service: Service
     created: float
     touched: float
+    hosted: bool = False
     codex_reserved: bool = False
     login_deadline: float = 0
     closed: bool = False
@@ -39,7 +40,7 @@ class Visitor:
 
 
 class Sessions:
-    def __init__(self, directory, origin, limits=None):
+    def __init__(self, directory, origin, limits=None, *, defaults=None):
         self.directory = Path(directory)
         self.origin = origin
         self.limits = limits or Limits()
@@ -47,6 +48,7 @@ class Sessions:
         self.ip_buckets = {}
         self.inference = 0
         self.http = None
+        self.defaults = dict(defaults or {})
 
     def rate(self, ip, kind, maximum):
         now = time.monotonic()
@@ -71,9 +73,12 @@ class Sessions:
         service = Service(
             self.directory / ident, "", {self.origin}, 8768, connections=MemoryConnections()
         )
+        service.connections.values.update(self.defaults)
         service.session = self.http
         now = time.monotonic()
-        visitor = Visitor(ident, secrets.token_urlsafe(32), service, now, now)
+        visitor = Visitor(
+            ident, secrets.token_urlsafe(32), service, now, now, hosted=bool(self.defaults)
+        )
         self.values[ident] = visitor
         return visitor