v0.3.0 — live Backrest v1.13.0 conformance + HTTP transport

Reconciled the mock-only v0.2.1 against the deployed Backrest v1.13.0 connect-rpc API (forge :9898). Field names target the deployed version, not upstream main (which has since diverged).

Fixed

• Broken standalone entrypoint — added missing if __name__ == "__main__": main() (python -m backrest_mcp.server was a silent no-op).
• get_summary failed-count field backupsFailedLast30days → backupsFailed30days; added warning/scanned fields.
• get_operations repo filter now resolves repo_id → repoGuid and fans out across repos when unfiltered.
• list_snapshots() no-arg HTTP 500 fixed by enumerating + merging repos (Backrest #223).

Added

• get_health, get_logs (Connect server-streaming), get_download_url.
• HTTP/PM2 transport (BACKREST_MCP_TRANSPORT=http) — loopback-only bind + mandatory StaticTokenVerifier bearer token; main() fails closed. stdio remains default.
• CI (ruff + pytest 3.11/3.12/3.13), otel/nats extras, live-conformance tests (BACKREST_LIVE_TEST=1).

Security

• Connect-stream decoder hardening (audit backrest-mcp-modernization-2026-07, Low): 64 MiB buffered-response cap + raises on a malformed frame whose declared length overruns the buffer, instead of silently truncating.

Changed

• list_snapshot_files argument repo_guid → repo_id (resolved to GUID internally; v1.13.0 wire field remains repo_guid).

Full notes: CHANGELOG.md.