v0.14.1 - Token expiry, strict ETags and live-subscription entitlements

Security

• Expired API tokens are now rejected. Creator-instance tokens with a sliding 24-hour expiry were previously accepted forever. User tokens without an expiry are unaffected.
• A member removed from an account no longer keeps receiving that account's chat streams on an open tab, and cannot resubscribe with a saved stream name.

Changes

• if_match is strict on all eight save tools (entries, collections, blueprints, globals, navigations, navigation items, templates, forms): a malformed or empty if_match is a conflict, not "skip the check". Only omitting it skips. Forms now carry an ETag (they previously returned null and errored on a well-formed if_match).
• Billing: plan-tier features are granted only from an active or paused subscription. A canceled, past-due or unpaid subscription no longer keeps its tier's features.
• The chat assistant can now use the account contexts tools (contexts_list, contexts_get, contexts_save, contexts_delete).
• Account subdomains are normalized (trimmed, lowercased) on save; a mixed-case subdomain that previously 404'd now resolves.