v0.2.0

Changed behaviour

• upload_media is now gated behind ETORO_MCP_UPLOAD_DIR: the tool registers only when the variable names an upload directory, resolved paths (symlinks included) must stay inside it, size is checked before reading, and content must carry a real JPEG/PNG signature (#1)
• The HTTP transport refuses non-loopback binds unless --allow-remote is passed, since the server is unauthenticated; the check runs before credentials load. Container deployments binding 0.0.0.0 internally need the flag — Docker examples updated (#3)

Fixes

• Retry-After parsing rejects non-finite values — NaN no longer reaches asyncio.sleep (#2)