fix: pip install now working

[kaliif]

pip install xchem-hippo silently installed 1.0.5 instead of 2.x. Not a
publishing failure — 2.0.2 was on PyPI and unyanked. Three independent blockers
made every 2.x candidate unresolvable, so pip backtracked to the last release
predating them. Silent because pip treats "no candidate for a dependency of
version V" as "reject V, try older".

Python	Blocker	Fix
3.10	django-rdkit is not on PyPI at all, and PyPI rejects direct-URL deps	MolField vendored into hippo/designdb/rdkit_fields.py
3.11–3.13	syndirella>=5.0.7a0 — every 5.x is >=3.10,<3.11	replaced with xchem-syndirella>=1.0.6, which lifted the cap

uv sync always worked, which is why this went unnoticed: [tool.uv.sources]
git deps are workspace-only, and uv does not enforce a dependency's
requires-python where pip does.

Changes

• hippo/designdb/rdkit_fields.py (new) — vendored MolField from
  django-rdkit (BSD-3, attribution retained): serialization mixins, the three
  cartridge lookups (hassubstruct, issubstruct, exact) and 34 descriptor
  transforms. RxnField/BfpField/SfpField omitted as unused.
• xchem-ta-auth-client>=1.0.0 replaces the copy of ta_auth_connector.py
  that had been vendored into the package; the target-access check in
  bootstrap.py is re-enabled.
• requires-python = ">=3.13" — floored by xchem-ta-auth-client.
  Deliberately no upper bound; see the comment in pyproject.toml.
• Dockerfile rebuilt on python:3.13-slim, replacing
  jupyter/minimal-notebook. One interpreter and one environment instead of a
  conda/venv pair bridged by PYTHONPATH, no forced NB_USER, and JupyterLab
  served from HIPPO's own dependency. Adds the system libraries the wheels
  expect (libexpat1, zlib1g, libx11-6, libxext6, libxrender1) and an
  import smoke test so a missing shared library fails the build rather than the
  first script run.
• tests/conftest.py — stubs the TA-authenticator lookup in the animal
  fixture, since an unset TA_AUTH_QUERY_KEY yields an empty access set and
  would make load_hippo() return None.
• Ruff target-version corrected to py313, and the vendored file cleaned up
  to satisfy the now-enabled linting of hippo/.

Verification

• pip install --dry-run of the built wheel resolves on 3.13; off-target
  interpreters fail loudly instead of silently downgrading.
• make lint clean; tests/test_compound.py + tests/test_pose.py
  = 3 passed, 1 skipped.
• Container builds and docker compose up serves JupyterLab; testscript_wf2.py
  runs.

Known limitations

• 1.0.x cannot be yanked (existing work depends on those releases), so the
  silent-fallback path stays open for unpinned installs on non-3.13
  interpreters. README now leads with a pinned install command and explains why.
• import syndirella requires PyRosetta, which is not installed:
  xchem-fragmenstein substitutes a mock that cannot satisfy submodule imports.
  This affects nothing today — HIPPO does not import syndirella — but it will
  need resolving before Pose.posebusters() is ported.