v0.3.1 — full 20-endpoint docs, per-request payment header fix

Fixed

• X-PAYMENT header is now scoped to the single retried request instead of being set on the shared httpx.Client's default headers — a spent payment authorization could otherwise leak into later unrelated calls on the same client instance.
• select_requirement() now hard-requires scheme=="exact" on the canonical USDC-on-Base asset/network instead of merely preferring it in a sort key.
• rights_lookup() validates asset_hash as a 64-character hex string before interpolating it into the request path.

Docs

• README and module docstring previously undersold the SDK ("3 paid resources"). All 20 client methods were verified live against app.suedeai.ai on 2026-07-07 — each returns a priced 402 challenge. Full breakdown now in the README, cross-linked to suede-x402-acp.
• rig_analyze, rig_oracle, rig_roast remain unconfirmed (did not return a valid 402 in the last verification pass) and are now called out as such instead of implied equally supported.