v0.3.43

7 bug fixes — 21 files changed, 1994 tests passing

**#496 — web_fetch panics on gzip responses:**
Enabled gzip/deflate/brotli decompression in reqwest. Fixed unsafe byte-index string truncation with safe_truncate_str. Finance sites (Yahoo Finance, Bloomberg, etc.) now work.

**#490 — UTF-8 boundary panic with CJK characters:**
Fixed 9 string slicing sites across 6 crates that panicked when byte index fell inside multi-byte UTF-8 characters (CJK = 3 bytes, emoji = 4 bytes). All now use char-boundary-safe truncation. 4 new CJK tests.

**#488 — Gemini tool schema still rejects oneOf/const/type-array:**
Extended schema normalizer to strip const, format fields. Handle oneOf same as anyOf (flatten or strip). Flatten type arrays like ["string","null"] to single type + nullable. 10 new tests.

**#500 — Hourly token rate limit not configurable:**
Added [budget] default_max_llm_tokens_per_hour to config.toml (0 = unlimited). Exposed in GET/PUT /api/budget API and dashboard. Per-agent override via PUT /api/budget/agents/{id}.

**#479 — Empty response with local LLM (LM Studio/Qwen3):**
Capture reasoning_content field from local LLMs (Qwen3, DeepSeek-R1). Extract <think> tags from inline content. Synthesize response from thinking when content is empty. Synthetic usage guard prevents false "silent failure" retries. 10 new tests.

**#495 — Voice messages lost when sent quickly:**
Bridge dispatch is now concurrent (tokio::spawn + Semaphore(32)) instead of sequential await. Per-agent message lock in kernel ensures session integrity while allowing parallel dispatch across agents.

**#494 — Custom model API keys lost on reload:**
resolve_driver() now checks both boot-time config AND runtime model catalog for provider URLs. Custom providers added via dashboard now resolve correctly. Fixed delete_provider_key for unknown providers.