fix: restore Python 3.10/3.11 support and report MCP version

- Drop backslash from f-string expression in markdown/html.py
- That syntax needs 3.12+ (PEP 701) and broke import on 3.10/3.11
- Add Python matrix 3.10/3.12/3.14/3.15 to the Gitea testing workflow
- Pass project_version() to MCPServer; serverInfo.version was empty
- Cover the reported version with an in-memory MCP client test
- Swap deprecated click.get_text_stream for sys.stdin.isatty()
- Add explicit encoding to native host shim and manifest writes
- Add explicit encoding to the registry lock file open
- Add explicit encoding to every read_text/write_text call in tests
- Bump version to 0.16.10 in pyproject.toml and extension/manifest.json
- Move .python-version to 3.15 and refresh uv.lock

Extension code is unchanged; only the manifest version string moved.

Verified with 778 tests on 3.10 through 3.15, plus a strict run using -X warn_default_encoding with EncodingWarning and DeprecationWarning as errors.

tests/test_new_feature_commands.py

@@ -245,7 +245,7 @@ def test_serve_tcp_rate_limit_zero_disables():
 
 def test_serve_tcp_per_key_policies_loaded_from_authorized_keys(tmp_path):
   keys = tmp_path / "authorized_keys"
-  keys.write_text("abc123 reader allow:read-page\ndef456 admin allow:all\nghi789 plain\n")
+  keys.write_text("abc123 reader allow:read-page\ndef456 admin allow:all\nghi789 plain\n", encoding="utf-8")
   security = _serve_security_for(["--authorized-keys", str(keys)])
   assert security.key_policies["abc123"] == CommandPolicy(allow_read_page=True)
   assert security.key_policies["def456"] == CommandPolicy.unrestricted()
@@ -260,7 +260,7 @@ def test_auth_trust_writes_inline_policy_token(tmp_path):
     "--allow-read-page", "--allow-control",
   ])
   assert result.exit_code == 0
-  line = keys.read_text().strip()
+  line = keys.read_text(encoding="utf-8").strip()
   assert line == f"{pub} ci bot allow:read-page,control"
 
 def test_auth_trust_without_allow_flags_writes_no_token(tmp_path):
@@ -268,11 +268,11 @@ def test_auth_trust_without_allow_flags_writes_no_token(tmp_path):
   pub = "b" * 64
   result = CliRunner().invoke(main, ["auth", "trust", pub, "--name", "plain", "--file", str(keys)])
   assert result.exit_code == 0
-  assert keys.read_text().strip() == f"{pub} plain"
+  assert keys.read_text(encoding="utf-8").strip() == f"{pub} plain"
 
 def test_auth_keys_local_shows_policy_column(tmp_path):
   keys = tmp_path / "authorized_keys"
-  keys.write_text(f"{'a' * 64} reader allow:read-page\n{'b' * 64} admin allow:all\n{'c' * 64} plain\n")
+  keys.write_text(f"{'a' * 64} reader allow:read-page\n{'b' * 64} admin allow:all\n{'c' * 64} plain\n", encoding="utf-8")
   result = CliRunner().invoke(main, ["auth", "keys", "--file", str(keys)])
   assert result.exit_code == 0
   assert "Policy" in result.output
@@ -286,37 +286,37 @@ def test_auth_keys_local_shows_policy_column(tmp_path):
 def test_auth_policy_updates_existing_key_policy(tmp_path):
   keys = tmp_path / "authorized_keys"
   pub = "a" * 64
-  keys.write_text(f"{pub} YubiKey 5C NFC FIPS\n")
+  keys.write_text(f"{pub} YubiKey 5C NFC FIPS\n", encoding="utf-8")
   result = CliRunner().invoke(main, [
     "auth", "policy", pub, "--file", str(keys), "--allow-read-page", "--allow-control",
   ])
   assert result.exit_code == 0
-  assert keys.read_text().strip() == f"{pub} YubiKey 5C NFC FIPS allow:read-page,control"
+  assert keys.read_text(encoding="utf-8").strip() == f"{pub} YubiKey 5C NFC FIPS allow:read-page,control"
   assert "Updated policy" in result.output
 
 def test_auth_policy_can_set_safe_and_server_default_by_name(tmp_path):
   keys = tmp_path / "authorized_keys"
   pub = "b" * 64
-  keys.write_text(f"{pub} laptop allow:all\n")
+  keys.write_text(f"{pub} laptop allow:all\n", encoding="utf-8")
 
   safe_result = CliRunner().invoke(main, ["auth", "policy", "laptop", "--file", str(keys), "--safe"])
   assert safe_result.exit_code == 0
-  assert keys.read_text().strip() == f"{pub} laptop allow:"
+  assert keys.read_text(encoding="utf-8").strip() == f"{pub} laptop allow:"
 
   default_result = CliRunner().invoke(main, ["auth", "policy", "laptop", "--file", str(keys), "--server-default"])
   assert default_result.exit_code == 0
-  assert keys.read_text().strip() == f"{pub} laptop"
+  assert keys.read_text(encoding="utf-8").strip() == f"{pub} laptop"
 
 def test_auth_policy_requires_policy_mode_when_not_interactive(tmp_path):
   keys = tmp_path / "authorized_keys"
-  keys.write_text(f"{'a' * 64} laptop\n")
+  keys.write_text(f"{'a' * 64} laptop\n", encoding="utf-8")
   result = CliRunner().invoke(main, ["auth", "policy", "laptop", "--file", str(keys)])
   assert result.exit_code == 1
   assert "Choose a policy mode" in result.output
 
 def test_auth_policy_rejects_conflicting_policy_modes(tmp_path):
   keys = tmp_path / "authorized_keys"
-  keys.write_text(f"{'a' * 64} laptop\n")
+  keys.write_text(f"{'a' * 64} laptop\n", encoding="utf-8")
   result = CliRunner().invoke(main, ["auth", "policy", "laptop", "--file", str(keys), "--safe", "--allow-all"])
   assert result.exit_code == 1
   assert "Choose exactly one policy mode" in result.output