release: prepare v0.7.4 - #181

Prepare OpenGUI 0.7.4 with the merged security and reliability fixes (#178, #179, #180).

Bump the application version and pinned Docker examples to 0.7.4, and document the changes.

• Security (fix(attachments): keep the Host token on the Host's origin #178): image previews send the Host credential only to the Host's own origin; only raster images become blob URLs; /api/fs/file refuses files over 25 MB. Hosts on 0.7.2 / 0.7.3 should update.
• Chat (fix(chat): end failed chat loads and restore a chat reopened mid-load #180): Session loads time out after 15 s, failed loads offer a retry, and returning to a chat mid-load shows it again.
• Files (fix(files): skip QA copies, task worktrees and .astro in @ file search #179): @ file suggestions skip .astro, .opengui-qa and .opengui-worktrees.

Validation:

• PR CI for fix(attachments): keep the Host token on the Host's origin #178, fix(files): skip QA copies, task worktrees and .astro in @ file search #179 and fix(chat): end failed chat loads and restore a chat reopened mid-load #180: Vite+ tests, session guards, build and Windows shell/process tests passed.
• Local on merged master: Vite+ check, full tests (1,635), architecture guards and production build passed.

🤖 Generated with Claude Code