Add --git flag to enable JSS git HTTP backend

Ensures git HTTP backend support is available in the underlying JSS.

Bump to 0.0.7, update JSS dep to >=0.0.136

…ng it (#5)

--auth <user:pass> was defined and documented but options.auth was
never read, and JSS has no basic-auth verification to forward to —
so 'servejss --auth user:pass ~/sync' served PUT/DELETE-enabled files
on 0.0.0.0 with no authentication while the user believed otherwise.

- error out with guidance (--read-only / --solid) when --auth is given
- say 'public, no auth' / 'Solid auth' in the banner Mode line, since
  jsserve's output filter swallows JSS's own PUBLIC MODE warning
- README: drop the --auth options row, replace the WebDAV example with
  honest unauthenticated + --solid variants
- drop stale '(requires #107)' comment; --public landed upstream

)

JSS used to seed a landing page and .acl files into the server root on
first start, polluting whatever directory servejss was pointed at.
Upstream fixed this in 0.0.211 (ec8547b, #578/#579): seeding is skipped
in --public and --read-only modes. Raise the dependency floor so every
install is guaranteed the guard, refresh the lockfile (resolves 0.0.212),
and bump to 0.0.8.

README notes the global-jss fallback: a stale global install also needs
updating, since bin/jsserve.js falls back to it when the bundled
dependency is missing.

….9) (#8)

servejss --plugin './chat/plugin.js@/chat' ./public serves the
directory and mounts the app in one command. The value is forwarded
verbatim to jss start --plugin (#594, JSS 0.0.217) — jsserve does no
plugin parsing, keeping the How-it-works split: JSS owns loading and
validation, the wrapper owns the CLI. Repeatable; mounts are listed
on a new Plugins banner line.

JSS floor raised to >=0.0.217 (the release with the flag), lockfile
refreshed, version bumped to 0.0.9. README gains the option, a
Static Site + Live App use case (with shell-quoting caveat for scoped
packages), and the Output example catches up with the 0.0.8 banner.