v2.1.0

Persistent auth + safer asset I/O

OAuth 2.1 refresh_token grant — connectors stay signed in for 90 days; access tokens rotate silently every hour without prompting the user.
Upstream Supabase tokens auto-refresh inside AuthGuard whenever they're within 2 minutes of expiry, so long-running tool calls never see a stale-token 401.
Asset URL gate (_gate_asset_url) on every studio_* tool: missing URL → structured asset_url_required response pointing at the public upload page; fabricated URL → HEAD preflight catches it before fal/wmstudio is billed.
Credit awareness: every successful generation appends creditsRemaining and a lowCreditsWarning when below threshold. HTTP 402 from wmstudio is rendered as a typed upgrade_required response with the dashboard top-up URL and the workflow halts.
studio_convert_to_3d default model changed to fal-ai/meshy/v6/image-to-3d (the only 3D endpoint wmstudio has a dedicated handler for). Hunyuan3D requests were silently failing field-validation downstream.
Three new env vars: ASSET_UPLOAD_URL, CREDITS_UPGRADE_URL, CREDITS_LOW_THRESHOLD.

v2.0.0

Studio surface

Pivot to the WM Studio creative tool surface: generation, image tools, characters, video, 3D.
12 typed studio_* tools, each with status (stable / beta / preview).
Async job model: long-running tools return job_id; clients poll.
Tool docs reorganised under 5 categories with capability matrix.

Initial release