v1.0.1 — verified against a live cabinet

First release verified against a real Avito Ads cabinet: 13 of the 25 tools were exercised end to end, and the wire protocol — derived from the official SDK because the public docs are unreachable — needed no corrections.

A bare 403 now explains itself. The token is minted for exactly one account, so a mismatched AVITO_ADS_ACCOUNT_ID fails with 403 Forbidden and an empty body — which reads like a permissions problem and is not. Tool errors and npm run smoke now name the variable to check; a 401 points at the credentials instead. A 403 that carries its own message is left untouched, so the hint never talks over the API.

Documented what the live API does and no upstream document mentions: the sandbox allows exactly one account per key, its test campaigns are generated only at creation time and only when a valid contract already exists, get_balance answers 404 there, INN/OGRN are checksum-verified, and addresses and phones must match the Russian formats. Corrected the claim that create_sandbox_account can be called twice — it cannot.

Full details in CHANGELOG.md.