v0.2.0 — policySlug on startPurchase + listPublicPolicies helper

Two additions, both responding to a real-world ask from the Recap
team building an in-app tier picker against the same Keysat
instance.

1. StartPurchaseOptions gains `policySlug?: string`. The daemon's
   /v1/purchase has accepted policy_slug since v0.1.0:27 (tiered
   pricing); the SDK was the only thing missing the field. With
   it set, the licensing service prices the invoice at the
   chosen policy's price_sats_override and remembers the policy
   on the invoice so the issued license carries that policy's
   entitlements / duration / max_machines / trial flag.

2. New `Client.listPublicPolicies(productSlug)` returns the
   buyer-visible tier list for a product (slug, name, price,
   entitlements, recurring + trial flags, "Most popular" flag).
   Same data the /buy/<slug> page renders server-side. Public
   endpoint — no auth. Lets in-app tier pickers render
   dynamically and stay in sync with admin-side tier setup.

Usage:

```ts
const tiers = await client.listPublicPolicies('recap')
// render tiers.policies in your UI; user clicks "Pro"
const session = await client.startPurchase('recap', {
  policySlug: 'pro',
  buyerEmail: 'buyer@example.com',
  redirectUrl: 'https://recap.app/thank-you',
})
window.location.href = session.checkoutUrl
```

15/15 existing crosscheck tests still pass — wire-format coverage
is unchanged. Bumps to 0.2.0 on minor since the API is purely
additive.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keysat/licensing-client",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Client library for Keysat. Verifies signed license keys offline and wraps the HTTP API for purchase and revocation checks.",
   "type": "module",
   "main": "./dist/index.cjs",