chore(python): upgrade to connectrpc 0.10.0 and pin all buf plugins

[stepan-romankov]

Closes #87.

Summary

• Bumps Python ConnectRPC runtime from connect-python==0.9.0 (deprecated) to connectrpc==0.10.0 — upstream renamed the PyPI distribution at v0.10.0 (module path connectrpc.X is unchanged).
• Pins all 8 previously-unpinned buf.gen.yaml plugins. The connectrpc/python:v0.10.0 pin is the actual fix for Upgrade connect-python to 1.10.0 #87; the other 7 match the version each language SDK already uses, so regen is a no-op for Go/Node/C#.
• Regenerates the 8 generated *_connect.py files (including system_connect.py from the merged SystemService PR feat: add SystemService.Health() auto-registered across all SDKs #90) to the v0.10 plugin shape (adds from connectrpc.codec import Codec and a codecs= kwarg on every ASGI/WSGI Application __init__).
• Drops the now-obsolete "manual patch on system_connect.py" notes from docs/SYSTEM_SERVICE.md and python/CLAUDE.md, and the matching "Known gaps" entry about unpinned buf plugins.
• Drops the now-stale "DO NOT use connectrpc from PyPI" warning across 6 Python docs (the PyPI name is now the official one as of v0.10.0; >=0.10.0 skips the squatted v0.0.1).

Why this is required

buf.gen.yaml did not pin buf.build/connectrpc/python, so every buf generate picks the latest plugin. The 0.10 plugin emits a codecs= kwarg that the 0.9 runtime currently locked in python/uv.lock doesn't accept. PR #90 worked around this by manually patching system_connect.py and documenting "re-apply the patch after every buf generate." This PR resolves the underlying drift: the runtime + plugin pair now match at 0.10.0, the manual patch is gone, and pinning all plugins keeps regen reproducible.

SDK source code: no changes

• network/client.py constructs clients with (base_url, http_client=…, timeout_ms=…) — still binds against the v0.10 client __init__.
• provider/handler.py passes only interceptors= to the generated Application classes; v0.10's new codecs=None default is filled by get_default_codecs().
• connectrpc.code.Code, connectrpc.errors.ConnectError, connectrpc.request.RequestContext/Headers are byte-identical between v0.9.0 and v0.10.0 (verified against upstream tags).

Behavioural note (no client-facing change)

Upstream PR connectrpc/connect-python#219 makes non-ConnectError handler exceptions re-raise after sending the wire response (logged via wsgi.errors in WSGI). All SDK interceptors raise ConnectError, so what a caller sees is unchanged — only stderr visibility improves when an unrelated bug raises a plain Exception.

Future upgrade workflow

Pinning is for reproducibility, not freezing. When a runtime SDK is bumped (Go/Node/Python/C#), bump the matching plugin pin in buf.gen.yaml in the same PR and run buf generate. The TODO in buf.gen.yaml is removed; a one-line note replaces it.

Test plan

• uv run pytest sdk/tests — 99/99 pass (matches issue Upgrade connect-python to 1.10.0 #87's stated baseline; includes PR feat: add SystemService.Health() auto-registered across all SDKs #90's SystemService tests)
• uv run ruff check . — clean
• Smoke import: from connectrpc.codec import Codec; from t0_provider_sdk.api.tzero.v1.system.system_connect import SystemServiceASGIApplication — ok
• go test ./... — green (verifies Go plugin pin produces no diff)
• npm run build && npm test (node/sdk) — 23/23
• dotnet build && dotnet test (csharp) — 54/54
• Independent code review, completeness audit, behavioural compatibility review (3 parallel agents) — clean
• CI green

Out of scope

• Java's java/sdk/buf.gen.yaml (already pinned).
• Bumping connectrpc.com/connect 1.19.1→1.19.2 in go/go.mod (open dependabot PR).
• python/tests/cross_test/go_helper build failure is pre-existing on master (its go.mod pins a Go module tag the local toolchain can't resolve) — unrelated to this PR.

🤖 Generated with Claude Code