Quantum 0.14.0

Fixed

A q:function of the page can be called inside a q:action (ACT-10). It was a 500 every time: actions ran in one runtime shared by every request and thread, which never registered the page's functions. Each request now gets its own runtime, so simultaneous requests cannot see each other's state either.
ui:* elements inside a served page are an error that says they are not supported there yet (UI-0); they came out as <window>/<vbox> tags no browser lays out. Building a UI from a file that is not <q:application type="ui"> says how to fix it instead of raising AttributeError. The console and desktop targets write different files (<id>_console.py, <id>_desktop.py); they both wrote <id>.py, so one erased the other.
accept on a q:param type="file" restricts the upload (ACT-11): it was accepted and never checked, so any file passed. The file name has to match as well as the type the browser declares — an .exe sent as image/png is refused.
returnType on q:function is checked on every return (FN-4); it was accepted and never read.
logging.format sets the format of log lines, and paths.migrations the folder quantum migrate reads (CFG-3); both were documented and ignored. Unknown keys under server, paths and logging are named in a warning, as they already were under security and performance.

Attributes that were accepted and never did anything are parse errors (PARSE-3): mask on q:set, transform on q:invoke, validation on q:param, basePath, health, metrics and trace on q:component. A test now scans the Core's AST nodes and fails when a field set from the XML is not read by anything that executes.
A q:function whose value does not match its returnType is an error; an unknown returnType is a parse error (FN-4).

The test suite runs in parallel in CI (pytest -n auto); pytest-xdist is in the [dev] extra. Tests that cannot share the machine are marked isolado.