Fix startup break on mcp 2.0.0, bound deps, add fresh-resolution CI

[pragprogrammer]

@
Fixes #21.

What broke

mcp-ynab declared mcp[cli]>=1.26.0 with no upper bound. The MCP Python SDK
released 2.0.0 on 2026-07-28 and removed mcp.server.fastmcp. Since resolution
happens at install time, the unchanged 1.0.3 wheel started failing at import for
everyone installing fresh, before any of our code ran.

Same wheel, only the resolver date differing:

Install	Resolves	Result
--exclude-newer 2026-07-27	mcp 1.28.1	starts, 47 tools
today	mcp 2.0.0	ModuleNotFoundError: No module named mcp.server.fastmcp

Local dev and CI both missed it because uv.lock pinned mcp 1.26.0, and
uv sync / uv run install from the lock. 1.29.0 and 2.0.0 shipped the same
day and 1.29.0 emits no deprecation warning, so nothing signalled it either.

The fix

FastMCP is MCPServer in 2.x. For this codebase it is a rename: the 47 tool
registrations, @handle_errors, and mcp.run(transport="stdio") are unchanged,
and there is only one import site.

Dependencies now carry upper bounds. httpx was the next one positioned to do
this to us: it is 0.x, so a 0.29 can break by convention, 1.0 prereleases are on
PyPI, and upstream development moved to Pydantic under the httpx2 name.
aiosqlite is deliberately left unbounded since it is never imported directly.
The pydantic floor moves to 2.12.0 to match what mcp 2.x already requires.

Preventing a repeat

scripts/smoke_test.py installs a built wheel into a clean venv with no
lockfile and drives the real entry point through an MCP stdio handshake. It
resolves from the declared constraints, which is the only way to see what a user
actually gets.

• ci.yml (new): push and PR. The repo previously had no CI except on release.
• canary.yml (new): weekly fresh resolve against live PyPI, plus a
  lowest-direct leg proving the declared floors are installable. Opens an
  issue on failure. This is the job that should have caught 2.0.0 on 07-28
  rather than a user catching it on 07-31.
• publish.yml: now gated on the smoke test, not just the locked test run.

Verification

Check	Result
uv run pytest	105 passed
Smoke, highest resolution	mcp 2.0.0, 47 tools, exit 0
Smoke, lowest-direct	pydantic 2.12.0 / sqlalchemy 2.0.41 / aiosqlite 0.21.0, exit 0
Smoke against published 1.0.3 wheel	exit 1 with the original traceback
uvx --from dist/*.whl mcp-ynab	initializes and serves
Live get_user / list_plans against real API	valid JSON, correct shape
Live get_plan with bad id	returns {"error": ...} string, not a protocol error

The third row is the one that matters: the new test was checked against the
actually-broken wheel to confirm it fails, not only that it passes on the fix.
@