Fix the issues found in the second review of 1.0.1

[DAB-LABS]

I had 1.0.1 looked at again, this time with someone deliberately trying to break it, and the first reviewer re-tested their own findings against it. Between them they found three real problems, all in the parts we added rather than in how the library talks to devices. This fixes them.

The main one is a cousin of the 1.0.1 bug. When the library resends a request after a second of silence and the device answers both copies, the second answer could still be mistaken for the reply to whatever came next. The other two: a re-authentication could let a queued request go out with a blank session, and a capture window could be taken away from a program that was still using it. The bench numbers for the timing fix are now in the README, and the code is formatted with the project's own tool, checked in CI.

Tested on Python 3.13 and 3.14, 257 tests, plus a live run against an RM4 Pro.

Coding assistant's notes on this change:

Reply matching now remembers every recently used packet counter (a deque of 64), not only those of timed-out requests, and drops any reply carrying one other than the current request's; a reply whose counter the device has not used recently is still accepted, for firmware that may not echo it. auth() does the session reset, the exchange and the key install as one unit under the request lock, so a request queued behind the lock is never framed with id 0 (a test reproduces the old interleaving with a fake that answers asynchronously). A new capture window gives asyncio's generator finalizer one turn to close a dropped generator, then raises CaptureInProgressError if the old window is still alive, instead of closing it from under a paused consumer; a refused attempt no longer displaces the live window. An undecodable returned packet is logged and the window re-arms. aclose() during a request raises EndpointClosedError (-4013, a subclass of ConnectionClosedError). hello() closes its scan generator, TimeoutError is spelled the 3.11+ way, the unused protocol future is gone, and there is debug logging on broadlink.device and broadlink.remote. The second commit is ruff format over the tree with the lint set widened to E, W, F, I, UP, B, ASYNC, RUF (ignores listed with reasons in pyproject) and ruff format --check added to CI; the oracle fixtures and repr/str output are unchanged.