feat(errors): add redacted typed transport failures

[Jason-Morcos]

Problem

The library currently reports protocol failures through broad built-ins such as ConnectionError, TimeoutError, and ValueError. Callers cannot reliably distinguish a closed session from a handshake failure, malformed CoAP, a bounded Blockwise abort, or a probe backend failure without parsing strings.

Several of those strings also interpolate remote endpoints, resource paths, or raw OpenSSL text. That makes normal exception reporting unsuitable for secret-safe diagnostics.

Public API added

smartthings_local.errors now provides a documented hierarchy rooted at SmartThingsLocalError:

• endpoint and probe failures
• session, timeout, and session-closed failures
• authentication and authorization failures
• malformed-message, Blockwise, and Observe failures

Each concrete error has a stable code, a fixed redacted message, and a deterministic repr. Arbitrary detail cannot be passed to the constructor. The existing session, probe, and CoAP boundaries now emit the appropriate concrete types where they already fail today.

OpenSSL handshake failures discard the raw exception context and chain only from a fixed DTLS backend failed marker, so raw backend text is retained in neither exception linkage nor the formatted traceback.

Backward compatibility

Every mapped error still subclasses the built-in callers previously caught:

• ConnectionError for session/probe/authentication/Blockwise/Observe errors
• TimeoutError for bounded session timeouts
• ValueError for malformed CoAP
• OSError for endpoint errors
• PermissionError for authorization errors

Constructor argument validation remains ValueError.

Scope

This PR does not change socket behavior, endpoint selection, retry policy, authentication policy, CoAP response handling, or Observe lifecycle. The unused taxonomy members establish names for those later contracts without implementing them here. It is independent of #21 and #22.

Validation

• Full suite with Python 3.14 / OpenSSL 3.6.3: 81 passed
• Focused error, CoAP, and probe suite: 45 passed
• Wheel and sdist builds include smartthings_local/errors.py
• Import directly from the built wheel: passed
• Compile check, new-file Ruff checks, and staged share-safety scan: passed

The LibreSSL compatibility fix from #22 is now included in upstream main; this branch is rebased on that fix and the merged validation workflow from #21.

[Jason-Morcos]

@codex review

[Jason-Morcos]

Adversarial follow-up complete for exact head 796ca39df5149cbba66a56ad4b594c1b7586343d. The handshake boundary now discards the raw OpenSSL exception context before raising the public SessionError; only the fixed DTLS backend failed cause remains. Regression coverage asserts both the formatted traceback and __context__ are secret-safe.

Validation: 66 passed on Python 3.14 / OpenSSL 3.6.3; 27 focused error tests passed; build/import, Ruff, diff, and introduced-content safety checks passed.

@codex review