Merge origin/main (license, compose, #65 leak guard) into cans work

docs/API.md

@@ -22,6 +22,10 @@ curl -X POST http://localhost:8080/api/pastes \
 
 - `expires_in` is a Go duration string (`90m`, `6h`, `336h`). Omit for no expiry.
 - `visibility` is `public` or `unlisted`.
+- Alternatively (or additionally), `public` may be sent as a boolean (#83):
+  `false` maps to `unlisted` and `true` maps to `public`. When both fields are
+  present, the boolean `public` takes precedence over the string `visibility`.
+  Omitting both defaults to `public`.
 - `burn_after_reads` sets how many reads the paste survives (default 1 when
   `burn_after_read` is true). A read is counted per unique viewer session;
   the same viewer returning within 15 minutes does not count again.