Apply senior-engineer review fixes across packaging, CI, and docs

[mahynski]

Real bugs:

• .readthedocs.yml referenced docs/requirements.txt which is never
  committed; switch RTD to install the package's new [docs] extra so
  builds work out of the box.
• docs/conf.py inserted ../my_package on sys.path (subpackages would
  import as top-level names); use ../ so autodoc resolves my_package.*.
• Drop hard pin pandas==2.1.4 to >=2.1.4 to unblock numpy 2.x stacks.

Packaging:

• Move dev tooling (pre-commit, pytest, mypy, IPython, ipykernel,
  ipywidgets, sphinx) out of runtime dependencies into [test], [docs],
  [notebook], and an aggregate [dev] extra.
• Fix Development Status classifier (5 -> 1) and add 3.10-3.13
  classifiers to match requires-python.

CI hardening:

• python-app.yml now runs a 3.10/3.11/3.12/3.13 matrix, installs the
  [test] extra, and uploads codecov only from the 3.12 leg with
  fail_ci_if_error=false. Added concurrency, least-privilege
  permissions, and timeout-minutes.
• pre-commit.yml and codeql.yml gain matching concurrency / timeout /
  permissions blocks.
• .gitlab-ci.yml synced to ruff/pytest, parallel matrix, and cobertura
  coverage report.

Template hygiene:

• README: replace blanket sed loop with a file-extension-restricted
  find, drop the now-stale pip-compile docs workflow, document the new
  extras, expand the pre-release checklist (CITATION + classifiers),
  and clarify the dev-branch caveat for CI triggers.
• docs/conf.py: dynamic copyright year, document how to enable
  sphinxcontrib-bibtex, and correct the misleading nbsphinx_execute
  comment.
• tests/test_example.py: add TODO marker so the no-op suite is not
  mistaken for real coverage; rename setUpClass parameter to cls.