iiiris v0.2.0 — HTJ2K decode + distroless default + IIIF compliance fixes

- **HTJ2K (JPEG 2000 Part 15) decode** via OpenJPEG ≥ 2.5.0. Accepts
  both boxed `.jp2`/`.jph` files and raw J2K codestreams (the default
  output of OpenJPH's `ojph_compress`). Encode remains classic Part 1.
- **Distroless container image is now the default release tag**:
  `:v0.2.0` and `:latest` ship a ~46 MB distroless image (static-linked
  libvips + OpenJPEG, no shell, no package manager). Debian-slim
  fallback at `:v0.2.0-debian` for operators who need shell tooling.
- **IIIF compliance fixes from a dockerized iiif-validator run**:
  - CORS `Access-Control-Allow-Origin: *` on every IIIF response.
  - `Accept: application/ld+json` content negotiation on `info.json`.
  - Slash-collapse middleware so `//foo`-style URLs route instead of
    301-redirecting (which many IIIF clients don't follow).
  - Validator coverage matrix: v3 14→3 failures (all upstream Python
    bugs); v2 went from "silently ran zero tests" to 21 tests run
    with 2 failures (same upstream bugs).

- **Default tag changes container image**: anyone pulling `:latest`
  after this release gets the distroless image. If you need a shell
  inside the container for debugging, pin to `:v0.2.0-debian`. See
  [docs/deployment.md](docs/deployment.md) for the comparison table
  and a rollback runbook.
- No config-file or env-var changes; existing configs continue to work.
- **CHANGELOG**: see [CHANGELOG.md](CHANGELOG.md) for the full list,
  including the test-coverage push (54% → ~78% project-wide).