Visual REST Client

### Added - Query parameter table that preserves repeated parameters, variable references, existing encoding, and URL fragments. - Cookie inspector with masked values, reveal controls, refresh, and clearing for the active file and environment. - Multipart form-data editor with text and file fields, and whole-file request bodies using portable `< ./file` references. Uploads enforce request-size limits. - Exact-byte response downloads, binary response notices, and text decoding using the response charset. - Postman Bearer, Basic, and API-key authentication import with collection/folder inheritance, request overrides, and warnings for unsupported auth and scripts. ### Fixed - Reject stale visual updates after external document changes and retain pending browser edits in a recovery copy instead of overwriting external requests. - Isolate extracted runtime variables by file and environment, including late responses after switching environments. - Bind cached OAuth credentials to the resolved profile configuration; changing the client, endpoint, scopes, or credential parameters requires fresh tokens.

### Added - GraphQL body mode with separate query and JSON variables, formatting, syntax diagnostics, operation selection, and drafts retained across request switches. - GraphQL POST queries and mutations through the existing auth and HTTP sender, including REST Client-format compatibility and JSON-safe variable resolution. - Expandable GraphQL response errors alongside HTTP status and partial data. - Postman GraphQL body import.

### Added - Added an extensible opaque-postamble parser for compatibility with external `.rest` tooling, including httpyac script blocks and assertions and IntelliJ-style response handlers. - Added standards-based, in-memory cookie jars that reuse response cookies in redirect hops and later requests while isolating sessions by REST file and active environment. ### Fixed - External post-response syntax is no longer displayed or sent as part of the request body and remains byte-for-byte intact when the body is edited. - Inline variables such as `{{username}}`, malformed script blocks, and unrecognized body text remain part of the request body.

### Added - Added case-insensitive response find in the tab bar for Body, Preview, Headers, and Request, with highlighting, result counts, wraparound navigation, and `Ctrl/Cmd+F` focus. - Preview navigation expands collapsed parent values and reveals matches inside long strings while retaining the JSON path context. - Added automatic root-level `.env` / `.env.*` environment loading with workspace-storage fallback and import/export migration tools. - Environment values are now masked by default with an accessible per-row reveal control independent of Secret Storage locking. ### Changed - Dotenv-backed environments are read-only in the Variables panel; migration actions deliberately move the full catalog between dotenv files and VS Code workspace storage. - Dotenv loading is workspace-root aware; migration is disabled in multi-root workspaces to protect the existing workspace-wide managed catalog. - Import and export warn that dotenv files are plaintext and are not automatically ignored by Git. ### Fixed - Aligned Method, URL, environment, Send/Cancel, and Save controls to the same request-bar height.