swarmexec v1.1.0 — port forwarding

Port forwarding: bind a local port and reach a port inside a container
anywhere in the swarm, without publishing it on the cluster. Available as
`swarmexec port-forward [local:]remote` and from the TUI with `p`, plus a
Forwards tab (3) to manage running forwards.

The agent reaches the target by joining its network namespace via a
sidecar from its own image — it generally shares no network with the
target. See DESIGN-port-forward.md for the constraint and the
measurements.

Wire protocol: adds the PortForward RPC (CONTRACT.md §3.2). Additive, so
the proto version stays swarmexec/v1 and older clients keep working. A
NEW client against an agent older than this release reports "agent is
older than this client — update it with `swarmexec init --force`", so
roll the agent out before relying on forwards.

Also in this release:
- Relicensed from proprietary to Apache-2.0, with NOTICE and a
  CONTRIBUTING.md requiring DCO sign-off.
- fix(resolve): dial the leader's real address instead of its hostname.
- fix(ui): restore vim movement in the overlay lists.
- Landing page for swarm-exec.logle.io, hardened as a non-root container.