[hlibsuslov]

Update the supported dependency baseline and Python runtime, and fix scan lifecycle and fetch failures that could leave resources open or scans running past their intended budgets.

• Refresh dependencies to current stable releases, test Python 3.11–3.15, and use a digest-pinned Python 3.15.2 container with commit-pinned CI actions.
• Close SQLite connections after commit/rollback; preserve explicit cancellations across shutdown; check scan ownership and publish results in one write transaction.
• Bound complete fetches and standalone DNS validation, normalize streaming failures into structured 502 responses, and drain shared analysis tasks before closing HTTP clients.
• Include attribution files in Docker-built wheels, verify wheel imports outside the checkout, and smoke-test the hardened container in CI. Update setup/lifecycle documentation and bump the package to 2.0.1.

Validation: 111 tests pass locally on Windows/Python 3.12 (90.07% coverage); Ruff, formatting, mypy, pip check, pip-audit, and sdist/wheel builds pass. Nine regression cases failed before the fixes. The installed wheel imports outside the checkout with all three license files. A browser scan of https://example.com completed through the real HTTP fetcher, persisted its page/SEO data, and opened the graph dashboard.

Compatibility: existing routes, response schemas, and scoring methodology remain unchanged. SEO_FETCH_TIMEOUT_SECONDS now bounds the complete fetch, including queueing and redirects, so deployments with long queues or slow upstreams may need to adjust this setting. All seven GitHub Actions jobs pass: Python 3.11, 3.12, 3.13, 3.14 and 3.15 tests, wheel packaging, and the hardened container health/license smoke test.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota. Try requesting a review at a lower effort level.