v0.2.0

release: 0.2.0 (required sdk_key + clock-rollback guard) (#1)

Breaking changes:
- KeylightConfig::builder now takes sdk_key as a required third argument
  (was an optional .sdk_key() setter). The server requires the key, so an
  unset key only ever produced rejected requests; making it a construction
  argument removes that misconfiguration class. sdk_key is now String, not
  Option<String>, and the X-Keylight-SDK-Key header is sent when non-empty.

New behavior:
- state() now forces LicenseState::Invalid when the system clock has rolled
  back beyond tolerance since the last recorded contact (clock::clock_rolled_back),
  closing the offline vector for reviving an expired lease. The check is
  read-only and UTC-based (timezone changes don't trip it), excludes the
  forward/offline-ceiling case (that stays with max_offline_days), and
  self-heals once a successful validate() re-anchors last_seen.

Also: factored the three serde_json::to_string(lease).unwrap() call sites in
client.rs into store_lease() with a documented infallibility invariant, and
the CLI now surfaces errors instead of panicking on network failures.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>