Release 0.10.0

A privilege-escalation fix in the Windows installer, the multi-site portability
work, and a documentation and API surface that a second site can rely on.

The installer created C:\shopdb-flask, C:\Python314 and C:\MySQL84 without
breaking inheritance from the drive root, whose default DACL grants
Authenticated Users an inherit-only Modify. Two files inside those roots are
executed by someone else - shopdb-admin.ps1 self-elevates, and instance
config.py is loaded unconditionally by the app - so any logged-on user could
replace either and wait. Verified fixed as SYSTEM in the Windows 11 VM against
the shipped functions.

Contract 0.19.0 is breaking: get_dashboard_widgets returns data and shape, not a
component name. The change itself shipped earlier without a bump, with the
contract docs still teaching the dead shape; both are corrected.

The version and the changelog are the release; the detail is in the entry.

docs/PROJECT-MAP.md

@@ -11,7 +11,7 @@ never by editing this file.
 
 | series | value | governed by |
 |---|---|---|
-| product `__version__` | `0.9.0` | ADR-007 |
+| product `__version__` | `0.10.0` | ADR-007 |
 | plugin contract `__contract_version__` | `0.19.0` | ADR-002 |
 
 They move independently. A contract bump is not a release.