feat!: require Python 3.15 and fix unsigned session cookies

BREAKING CHANGE: the minimum supported Python version is now 3.15.

Python 3.15:

- Raise requires-python from >=3.13 to >=3.15.
- Replace the 3.13 trove classifier with 3.15.
- Pin the toolchain via a .python-version file.
- Pin setup-uv to Python 3.15 in the publish workflow.
- Correct the stale "Python 3.7.0 or higher" claim in the README.
- Verified against CPython 3.15.0; all extras resolve to 3.15 wheels.

Session cookie fixes:

- Fix save_session() crashing with AttributeError on every request.
- The str sid was decoded as bytes when SESSION_USE_SIGNER is off.
- That is the default, so it broke the stock configuration.
- Only decode in the signer branch, where sign() actually returns bytes.
- Handle a missing secret_key instead of calling sign() on None.
- A missing signer now warns and skips the cookie, like open_session().
- Both bugs predate this release and affect all Python 3 versions.

Tests:

- Add a pytest suite; the project previously had no tests at all.
- Cover the cookie round-trip for both signed and unsigned sessions.
- Cover session state surviving a follow-up request.
- Cover the missing secret_key path.
- Three of the five tests fail without the save_session() fix.
- Add pytest and pytest-asyncio to the dev dependency group.
- Enable asyncio_mode = "auto" so tests need no per-test markers.

Version:

- Bump the package version to 4.0.0.
- Derive __version__ from installed package metadata.
- It was hardcoded and had drifted to 3.0.0 while the release was 3.0.2.
- pyproject.toml is now the single source of truth for the version.
- Commit uv.lock to pin the development environment.

tests/conftest.py

@@ -0,0 +1,45 @@
+from typing import Optional
+
+import pytest
+from quart import Quart, session
+
+from quart_session import Session
+
+@pytest.fixture
+def app_factory():
+    """Builds a Quart app backed by an in-memory session store."""
+
+    def _factory(**config) -> Quart:
+        app = Quart(__name__)
+        app.secret_key = "test-secret-key"
+        app.config["SESSION_TYPE"] = "null"
+        app.config.update(config)
+        Session(app)
+
+        # 'null' interface is a no-op store, give it a dict so that
+        # open_session() can actually find data again.
+        store: dict = {}
+        interface = app.session_interface
+
+        async def _get(key: str, app: Optional[Quart] = None):
+            return store.get(key)
+
+        async def _set(key: str, value, expiry: Optional[int] = None,
+                       app: Optional[Quart] = None):
+            store[key] = value
+
+        async def _delete(key: str, app: Optional[Quart] = None):
+            store.pop(key, None)
+
+        interface.get = _get
+        interface.set = _set
+        interface.delete = _delete
+
+        @app.route("/")
+        async def index():
+            session["hits"] = session.get("hits", 0) + 1
+            return {"hits": session["hits"], "sid": session.sid}
+
+        return app
+
+    return _factory

tests/test_session_cookie.py

@@ -0,0 +1,60 @@
+import pytest
+from itsdangerous import Signer
+
+def _cookie_value(response, name="session"):
+    header = response.headers.get("Set-Cookie")
+    assert header is not None, "no Set-Cookie header was sent"
+    assert header.startswith(f"{name}=")
+    return header[len(name) + 1:].split(";", 1)[0]
+
+@pytest.mark.asyncio
+async def test_unsigned_cookie_is_plain_sid(app_factory):
+    """Regression: str sid used to blow up with AttributeError on .decode()."""
+    app = app_factory(SESSION_USE_SIGNER=False)
+    client = app.test_client()
+
+    response = await client.get("/")
+
+    assert response.status_code == 200
+    data = await response.get_json()
+    assert data["hits"] == 1
+    assert _cookie_value(response) == data["sid"]
+
+@pytest.mark.asyncio
+async def test_signed_cookie_is_signed_sid(app_factory):
+    app = app_factory(SESSION_USE_SIGNER=True)
+    client = app.test_client()
+
+    response = await client.get("/")
+
+    assert response.status_code == 200
+    data = await response.get_json()
+    cookie = _cookie_value(response)
+    assert cookie != data["sid"]
+
+    signer = Signer(app.secret_key, salt="quart-session",
+                    key_derivation="hmac")
+    assert signer.unsign(cookie).decode() == data["sid"]
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("use_signer", [False, True])
+async def test_session_survives_next_request(app_factory, use_signer):
+    app = app_factory(SESSION_USE_SIGNER=use_signer)
+    client = app.test_client()
+
+    first = await client.get("/")
+    second = await client.get("/")
+
+    assert (await first.get_json())["hits"] == 1
+    assert (await second.get_json())["hits"] == 2
+
+@pytest.mark.asyncio
+async def test_signer_without_secret_key_sets_no_cookie(app_factory):
+    app = app_factory(SESSION_USE_SIGNER=True)
+    app.secret_key = None
+    client = app.test_client()
+
+    response = await client.get("/")
+
+    assert response.status_code == 200
+    assert response.headers.get("Set-Cookie") is None