chore(release): 0.3.2 — canonicalize repo URLs to SharpAPI-Python

Update Repository and Changelog URLs in package metadata to match the
post-rename canonical case. The lowercase form continues to redirect on
GitHub but the canonical form is what should appear on the PyPI page.

Metadata-only release; no code changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

feat(types): nested refs + TeamRef metadata (0.3.0 / 0.3.1) (#7)

## Summary

Two related additions to the type model, both additive and non-breaking:

**0.3.0 — nested refs**
- New types: `TeamRef`, `SportRef`, `EntityRef`, `Team`
- Existing odds + opportunity rows extend with optional `home`, `away`,
`sport_ref`, `league_ref`, `market_ref`, `sportsbook_ref`
- `ArbitrageLeg` gains `sportsbook_ref`; `ClosingOddsLine` gains
`market_ref` + `sportsbook_ref`
- Reference rows (`Sport`, `League`, `Sportsbook`, `Market`) gain
`numerical_id`; `Team` adds `abbreviation` + `numerical_id`

**0.3.1 — TeamRef metadata**
- `TeamRef` and the `Team` reference shape gain optional `logo`, `city`,
`mascot`, `conference`, `division`. ~93% coverage on `logo`, similar on
the rest. All five default to `None`.

## Plus a public-release cleanup pass

- Add MIT `LICENSE` and `SECURITY.md`
- Untrack `tests/` and add to `.gitignore` (kept locally for dev); CI
gate is now lint + typecheck across the 3.10–3.13 matrix
- Tighten sdist via `[tool.hatch.build.targets.sdist]` so `.github/`
workflows no longer ship to PyPI sdist
- Update author email to `[email protected]`
- Misc internal-comment cleanup

## Compatibility

No existing field renamed, retyped, or removed. Code on 0.2.x continues
to work.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>

feat(auth): support Bearer token alongside X-API-Key

Add an optional ``auth_method`` keyword on the ``SharpAPI`` and
``AsyncSharpAPI`` constructors. Defaults to ``"x-api-key"`` (existing
behaviour — fully back-compat; no caller changes required). When set to
``"bearer"`` the SDK sends ``Authorization: Bearer <key>`` instead of
the ``X-API-Key`` header, matching the Go server's three accepted REST
auth modes (header, Bearer, query).

Why: customers running behind IAM layers, SSO gateways, or corporate
proxies often have non-standard headers stripped or rewritten. Standard
``Authorization: Bearer`` survives those hops and integrates cleanly
with off-the-shelf auth middleware.

SSE streams are intentionally unchanged — they always authenticate via
the ``?api_key=`` query param because the EventSource spec does not
allow custom request headers.

Bumps version 0.2.4 -> 0.2.5 (new public API surface). Adds 2 tests
(sync + async) verifying the Bearer header is sent and X-API-Key is
omitted in bearer mode.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

chore: release v0.2.2

- Add retry for transient upstream failures - Drop Python 3.9 support (EOL 2025-10)
- Bump USER_AGENT to match package version

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

fix: remove events.search() — endpoint not implemented on server

Server returns 404 for /api/v1/events/search; one client running
0.2.0 generated ~38k 404s today. Removing the method until the
server-side endpoint exists.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

feat: v0.2.0 — use canonical field names with backwards compat

Rename EVOpportunity model fields to match canonical API names:
- ev_percent → ev_percentage
- true_probability → fair_probability
- devig_book → sharp_book
- kelly_fraction → kelly_percent

Uses Pydantic AliasChoices so the SDK accepts both old and new field
names from API responses, maintaining full backwards compatibility.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>