predictalot v0.2.0 — type-routed API

Breaking change: /v1/forecast and /v1/models are removed and replaced
by six per-type endpoint triples under /v1/<type>/. MCP rewritten to
26 per-(type, model) tools. Adds hardening around streaming body size,
NaN/Infinity weights, jagged multivariate channels, covariate shape,
and non-ASCII bearer-token comparison. Lockfile fallback removed from
prod Dockerfiles. Lint baseline (.flake8) aligned with black.