v0.2.14

Changes: add note_set_eyecatch_image_file for OpenAI Apps SDK file-parameter eyecatch uploads; validate images via magic bytes and Pillow; avoid logging download_url; allow PNG/JPEG/WebP/GIF; reject SVG; keep existing file_path and chunked base64 fallback paths. Validation: Python ruff passed, Python unit+contract tests passed with 769 passed and existing warnings only, JS node tests passed 7 tests though the existing npm build script still emits TypeScript configuration diagnostics before continuing.

Full Changelog: v0.2.13...v0.2.14