v0.4.0 - Process all medium audit findings

Processes the full Medium-level batch from the May 2026 security + DevOps audits, plus the deferred HIGH-severity result.error sanitization. No breaking changes.

Security

• H3 — pexels_preview_media summary error sanitized (max 80 chars, single line) before model injection.
• M1 — previews.py HTTP client now uses follow_redirects=False; closes the redirect-chain SSRF vector.
• M3 — collection_id validated against ^[A-Za-z0-9_-]+$.
• M4 — locale validated against the documented SUPPORTED_LOCALES allowlist.
• M5 — publish.yml re-enabled with the tag trigger, mandatory needs: test gate, pypi deployment environment guard.
• L1 — Bearer auth log records only the remote IP (not port).

DevOps / SRE

• GET /readyz readiness probe added alongside /healthz.
• ghcr.io/astral-sh/uv:0.7 pinned to OCI digest sha256:6292…cc70.
• Retry backoff is now jittered (base 1.0s × [0.25, 0.75]) — fixes event-loop stalls during bursty AI sessions.
• Dependabot groups mcp / httpx / pydantic / uvicorn minor+patch bumps into one weekly runtime-dependencies PR.

Test coverage

• New tests/test_transport.py (12 tests) covers all three ASGI middlewares.
• 59 tests total (vs 41 in v0.3.0), all green on Python 3.10 / 3.11 / 3.12.

Full changelog

https://github.com/VictorNain26/pexels-mcp-server/blob/v0.4.0/CHANGELOG.md