v2.0.4

Added

• Signed render URL: Script ads now load via a server-rendered URL (renderUrl) with a short-lived HMAC token. The API key never appears in iframe URLs or browser logs.
• renderUrl field on AdResponse and AdApiResponse.

Changed

• Iframe strategy: When renderUrl is available (default), the iframe loads the signed server URL (CSP controlled server-side). Falls back to sandboxed data: URI when no render URL is present.