0.3.2

## New Web APIs
- **Drag-and-drop file upload**: `DataTransfer`, `DataTransferItem`, `DataTransferItemList` + `DragEvent`
- **File inputs**: `input type=file` support (`FileList`, `input.files`/`value`, `DOM.setFileInputFiles`), multipart/form-data encoding on submit
- `CookieStore` web API; WebSocket cookies; cleaner cookie ownership
- `Notification` web API
- `DOMMatrix` / `DOMMatrixReadOnly`, `StaticRange`
- **Shadow DOM**: declarative shadow DOM (DSD), WPT improvements, markdown-dump piercing
- **Popover** support (initial)
- Web Crypto API (`atob`/`btoa` fixes, WPT `/WebCryptoAPI/`)
- `XMLHttpRequest.upload` and `XMLHttpRequest.overrideMimeType()`
- `Element.scroll`/`scrollTo`/`scrollBy`, `Element.scrollIntoView`, `Element.offsetParent`, `Element.style` setter
- `Node.lookupPrefix`
- `HTMLSelectElement.type`, `HTMLOptionElement.label`
- Attribute reflection for `HTMLSourceElement`, `HTMLEmbedElement`, `HTMLParamElement` (plus more HTML attribute tweaks)
- `readystatechange` fired at document; module-type workers; `postMessage`/`MessageEvent` MessagePort tracking
- localStorage/sessionStorage persistence across navigations + quota fix

## URL handling
- **Reworked URL web API on top of rust-url** (new dependency + bindings)
- Ignore query/fragment slashes in URL resolve; about:blank iframes/popups inherit parent base_url; schema-less URL navigation; unified Data URLs; WPT `/url/` improvements

## CDP (Chrome DevTools Protocol)
- `Input.dispatchMouseEvent`: mouse button + clickCount, wheel events, mouseup, hover/mousemove events
- `Page.navigate` answers with `errorText` on navigation failure
- `setExtraHTTPHeaders` can override built-in headers (e.g. User-Agent) with validation
- `console.log`/`console.warn` reported with their own `consoleAPICalled` types
- WPT action_sequence support; actionSequence fired on next tick

## HTTP / Networking
- 3xx responses without a `Location` header delivered as final responses; stricter redirect status checks
- WebSocket sends `Origin` header on upgrade
- Server-side agent-discovery signals: `Link` response header (RFC 8288) + robots.txt Content-Signal
- TCP read/write timeout extended 2s → 10s
- `--wait-until` gains `networkalmostidle`
- Module/script preloading; capture 401/407 bodies

## Performance
- Preload modules and scripts
- Optimized `IntersectionObserver`
- Reduced generated code size of the logger; less generic use
- Avoid excessive `tabIndex` lookup/parse; sequential focus navigation on Tab

## Other / behavior
- `navigator.globalPrivacyControl` defaults to `false`; removed `navigator.getBattery` dummy
- Password inputs mapped to textbox accessibility role
- Relative `:has()` selector arguments (`:has(> div)`, `:has(~ p)`); better CSS name selector parser
- Viewport default sourced from `MediaQuery.Viewport.default` (1920×1080)

## Stability fixes
- Multiple UAF/double-free/leak fixes: FormData arena, WebSocket cleanup, synthetic URLs, CustomElement definitions, FinalizerCallback identity, frame teardown orphaned contexts, log messages
- More robust worker/CDP-client disconnect handling; re-entrant stream parsing guard

## CI / dev
- Fixed leaky thread in test runner; improved ArenaPool debug reporting