anafpy 0.13.3 — dependencies brought current, and error messages kept

A maintenance release: every dependency in the lock moves to its current
version, and the one upgrade that changed behaviour is absorbed rather than
passed on.

What the MCP SDK upgrade would have cost

The MCP SDK's 2.2 line draws a line it did not draw before. A failure a tool
anticipated — raised as the SDK's own ToolError — reaches the model with its
message. Anything else is treated as a crash: the model is told
Error executing tool spv_cerere and nothing more.

anafpy's tools raise anafpy's errors, and those messages are not decoration.
They are how a flow repairs itself: a wrong report type answers with the valid
ones, a mistyped motiv with ANAF's fixed list, a name collision with the
refusal to overwrite and the way to override it, a missing session with the
tool that logs in. On the new SDK every one of them collapsed into the same
generic line — and a fresh pip install "anafpy[mcp]" of 0.13.2 resolves to
that SDK today.

The server now translates once, at the top: an anafpy error leaving a tool or a
resource is reported as the anticipated failure it is, with its text. A genuine
crash still gets the SDK's redaction. anafpy[mcp] requires mcp>=2.2.

If you installed 0.13.2 from PyPI recently and the assistant started answering
ANAF problems with unexplained "Error executing tool" lines, this is the fix.
The Claude Desktop extension bundles carry their own locked dependencies and
were not affected.

Dependencies

Notable moves in the lock, all exercised by the suite:

• mcp 2.0 → 2.2
• httpx2 2.9 → 2.13
• cryptography 49 → 50
• pyhanko 0.35 → 0.37 — it now brings aiohttp with it, so the
  anafpy[declaratii] install and the extension bundles grow by that closure
• cyclopts 4 → 5 — the CLI is unchanged
• pydantic 2.13.5, parsel 1.12, pyjwt 2.15, fpdf2 2.8.8

The declared minimums are unchanged apart from mcp.

Also in this release

• A test of the e-Factura listing's clock correction compared a fixed July date
  against the machine's clock, and began failing once that date fell out of
  ANAF's 60-day window. The test now pins the clock; the library was never
  wrong.
• ruff 0.16 formats the Python examples inside Markdown. The docs' examples are
  laid out by hand, so the formatter is scoped to the code.

Live-confirmed

The upgraded lock was run against ANAF and BNR before tagging: the OAuth token
and both listings, an e-Factura and an e-Transport filing round-trip on TEST,
ANAF's validare and transformare, the public lookups, BNR's rate feed, and
DUKIntegrator's install, validation and rendering. httpx2 2.13 carries all of
them.

Not yet verified

• The certificate logins — SPV and the declaration portal. Both fire the
  certificate 2FA and were not re-run; the SPV listing could not be checked
  because the stored session had expired.
• Signing on a real token with pyhanko 0.37. The mocked sign-and-validate
  round-trip passes.
• StareD112. ANAF reset every connection to the page during the run — the
  previous release's dependencies and plain curl got the same answer, so it
  says nothing about this release either way.

Full changelog: v0.13.2...v0.13.3