feat!: require Python 3.15 and fix unsigned session cookies

BREAKING CHANGE: the minimum supported Python version is now 3.15.

Python 3.15:

- Raise requires-python from >=3.13 to >=3.15.
- Replace the 3.13 trove classifier with 3.15.
- Pin the toolchain via a .python-version file.
- Pin setup-uv to Python 3.15 in the publish workflow.
- Correct the stale "Python 3.7.0 or higher" claim in the README.
- Verified against CPython 3.15.0; all extras resolve to 3.15 wheels.

Session cookie fixes:

- Fix save_session() crashing with AttributeError on every request.
- The str sid was decoded as bytes when SESSION_USE_SIGNER is off.
- That is the default, so it broke the stock configuration.
- Only decode in the signer branch, where sign() actually returns bytes.
- Handle a missing secret_key instead of calling sign() on None.
- A missing signer now warns and skips the cookie, like open_session().
- Both bugs predate this release and affect all Python 3 versions.

Tests:

- Add a pytest suite; the project previously had no tests at all.
- Cover the cookie round-trip for both signed and unsigned sessions.
- Cover session state surviving a follow-up request.
- Cover the missing secret_key path.
- Three of the five tests fail without the save_session() fix.
- Add pytest and pytest-asyncio to the dev dependency group.
- Enable asyncio_mode = "auto" so tests need no per-test markers.

Version:

- Bump the package version to 4.0.0.
- Derive __version__ from installed package metadata.
- It was hardcoded and had drifted to 3.0.0 while the release was 3.0.2.
- pyproject.toml is now the single source of truth for the version.
- Commit uv.lock to pin the development environment.

quart_session/__init__.py

@@ -10,9 +10,13 @@
     :license: BSD, see LICENSE for more details.
 """
 
-__version__ = '3.0.0'
-
 import os
+from importlib.metadata import PackageNotFoundError, version as _pkg_version
+
+try:
+    __version__ = _pkg_version("quart-session")
+except PackageNotFoundError:  # running from a source tree without install
+    __version__ = "unknown"
 
 from quart import Quart
 

quart_session/sessions.py

@@ -186,10 +186,15 @@ class SessionInterface(QuartSessionInterface):
 
         await self.set(key=session_key, value=val, app=app)
         if self.use_signer:
-            session_id = self._get_signer(app).sign(want_bytes(session.sid))
+            signer = self._get_signer(app)
+            if signer is None:
+                app.logger.warning("Failed to obtain a valid signer, "
+                                   "not setting a session cookie.")
+                return
+            session_id = signer.sign(want_bytes(session.sid)).decode('utf-8')
         else:
             session_id = session.sid
-        response.set_cookie(cname, session_id.decode('utf-8'),
+        response.set_cookie(cname, session_id,
                             expires=expires, httponly=httponly,
                             domain=domain, path=path, secure=secure, samesite=samesite)