fix: resolve all security scan findings (3 HIGH, 4 MEDIUM)

[KhaledSalhab-Develeap]

Summary

Fixes all 7 actionable findings from the security vulnerability scan.

HIGH (3)

• Retry-After header crash: float() on the raw Retry-After header value was unguarded. RFC 7231 allows HTTP-date strings (e.g., "Fri, 31 Dec 2025 23:59:59 GMT"), which would throw ValueError and crash the retry loop. Now wrapped in try/except, falling back to exponential backoff.
• GitHub Actions pinned to commit SHAs (H11): All 6 action references across both workflows are now pinned to full 40-char SHAs instead of mutable tags, closing the supply chain vector.
• Publish audit step now blocking: Removed continue-on-error: true from publish.yml so vulnerable dependencies cannot ship to PyPI. CI workflow audit stays soft to avoid blocking development.

MEDIUM (4)

• Log sanitization: Removed raw API response dicts from parse_list warning logs to prevent leaking subscriber emails or custom auth headers.
• API key validation: HyperpingClient(api_key="") now raises ValueError immediately instead of producing confusing 401 errors.
• .gitignore hardened: Added .env, .env.*, .env.local exclusions.
• get_headers_dict() documented: Added warning that returned dict may contain sensitive values (e.g., Authorization tokens configured on monitors).

Test plan

• ruff check src tests - All checks passed
• mypy src - 0 errors in 19 files
• pytest - 177 passed, 91.5% coverage (threshold 85%)