chore(release): 0.3.2 — canonicalize repo URLs to SharpAPI-TS

Update repository.url and bugs URLs in package.json to match the
post-rename canonical case. The lowercase form continues to redirect on
GitHub but the canonical form is what should appear on the npm page.

Also drop deleted tests/ from the biome lint glob (was breaking CI lint
gate after tests were untracked from the repo).

Metadata-only release plus the lint-script fix; no source changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

feat(types): nested refs + TeamRef metadata (0.3.0 / 0.3.1) (#7)

## Summary

Two related additions to the type model, both additive and non-breaking:

**0.3.0 — nested refs**
- New interfaces: `TeamRef`, `SportRef`, `EntityRef`, `Team`, `Market`,
`NestedRefs` bundle
- Typed `LowHoldOpportunity` (was loosely typed before)
- Existing `NormalizedOdds`, `EVOpportunity`, `ArbitrageOpportunity`,
`MiddleOpportunity` extend with optional nested refs via `NestedRefs`
- `ArbitrageLeg` gains `sportsbook_ref`; `ClosingOdd` gains `market_ref`
+ `sportsbook_ref`
- Reference rows (`Sport`, `League`, `Sportsbook`, `Market`) gain
`numerical_id`; `Team` adds `abbreviation` + `numerical_id`

**0.3.1 — TeamRef metadata**
- `TeamRef` and the `Team` reference shape gain optional `logo`, `city`,
`mascot`, `conference`, `division`. ~93% coverage on `logo`, similar on
the rest. All five default to `undefined`.

## Plus a public-release cleanup pass

- Add MIT `LICENSE` and `SECURITY.md`
- Fix package-scope mismatch: README install + JSDoc `import` example
now point at `@sharp-api/client` (matches `package.json`; the previous
`@sharpapi/client` 404'd)
- Untrack `tests/` and add to `.gitignore` (kept locally for dev); CI
gate is now biome + tsc across Node 18/20/22
- Strip `sourcesContent` from `.map` files via `tsup` `esbuildOptions`
so the npm tarball no longer ships a full copy of `src/index.ts`;
tarball 57.7 kB → 31.0 kB
- Update author email to `[email protected]`
- Misc internal-comment cleanup

## Compatibility

No existing field renamed, retyped, or removed. Code on 0.2.x continues
to compile.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>

ci: re-enable NPM_TOKEN fallback (OIDC test failed), bump to 0.2.8

v0.2.7 OIDC test repeated the same 404 we saw on v0.2.5. Trusted
Publisher binding IS visible on npmjs.com but isn't authenticating
the publish — likely needs the package access mode to flip from
"Require 2FA OR token" to "Require 2FA AND disallow tokens" on the
npm UI to fully activate OIDC.

Restoring NPM_TOKEN env var until that's tested. v0.2.7 release
deleted (orphan tag). Cutting v0.2.8.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

chore: bump 0.2.5 → 0.2.6 to retry npm publish

v0.2.5 release tagged at a commit before the publish.yml NPM_TOKEN
fallback fix (b8e3464). gh run rerun used the workflow file from
the tagged commit (without the fix), so it failed identically.

Bumping to 0.2.6 and cutting a fresh release from main (which has
the workflow fix). Same source code as 0.2.5 — only difference is
the publish workflow now has NPM_TOKEN auth.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

chore: release v0.2.2

Add retry for transient upstream failures .

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

fix: align resource paths with the deployed Go server (0.2.1)

Eight methods in @sharp-api/[email protected] called endpoints that don't exist
on api.sharpapi.io and 404'd in production. This release renames the broken
paths and removes the methods that have no server-side counterpart.

Path renames (now reach a real handler):
 api.ev.get /api/v1/positive-ev → /api/v1/opportunities/ev
 api.arbitrage.* /api/v1/arbitrage → /api/v1/opportunities/arbitrage
 api.account.me /api/v1/me → /api/v1/account
 api.account.usage /api/v1/me/usage → /api/v1/account/usage
 api.odds.batch POST /api/v1/odds/multi → POST /api/v1/odds/batch
 (method renamed from .multi to .batch to match)

Method removals (no server endpoint, never worked):
 api.events.search — no /events/search handler
 api.schedule.get — no /schedule handler
 api.schedule.live — no /schedule/live handler
 api.valueBets.get — no /value-bets handler

Deleted types: ScheduleParams, ValueBetsParams, ValueBet.

This is technically a strict-semver breaking change since four methods
disappear from the public API, but every removed method already 404'd at
runtime in 0.2.0 — the only practical break is a TypeScript compile error
for callers that imported the dead methods.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

feat: v0.2.0 — rename evPercent to evPercentage

Align EVOpportunity.evPercent with canonical API field ev_percentage.
Other fields (fairProbability, sharpBook, kellyPercent) already matched.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>