chore: release v0.0.28

Exempt SPA static assets and admin HTML shell from silo HTTP rate limit so
page loads no longer exhaust HUB_HTTP_REQUESTS_PER_MINUTE.

hub/src/deployment/siloRateLimit.ts

@@ -1,3 +1,27 @@
+/**
+ * Silo-wide HTTP request rate limit (ADR-0022 `requestRate`).
+ *
+ * Counts dynamic traffic only: APIs, auth, and other application handlers.
+ * Static SPA assets and the org-admin HTML shell are exempt so a single page
+ * load (dozens of `/_app/*` chunks + favicon) does not exhaust the minute budget.
+ */
+
+/** Paths that must not consume the silo HTTP request-rate budget. */
+export function isSiloHttpRateLimitExempt(url: string): boolean {
+  const path = (url.split("?", 1)[0] ?? url) || "/";
+
+  if (path === "/api/healthz") return true;
+
+  // SvelteKit build output and top-level static files (see admin/static.ts).
+  if (path === "/_app" || path.startsWith("/_app/")) return true;
+  if (path === "/favicon.ico" || path === "/favicon.svg" || path === "/robots.txt") return true;
+
+  // SPA index shell for client-side routes (not an API).
+  if (path === "/admin" || path.startsWith("/admin/")) return true;
+
+  return false;
+}
+
 export class SiloFixedWindowRateLimiter {
   private windowStartedAt: number;
   private used = 0;