feat(server): add V3 HMAC framing

[gijzelaerr]

Summary

• verify HMAC-SHA256 on incoming V3 server requests and sign every V3 response
• validate V3 response HMACs in the sync client, including reassembled Explore frames
• carry V3 response IntegrityIds without exposing them to response parsers
• add end-to-end SessionKey tests covering connect, read, write, and Explore

The emulator accepts an explicit 24-byte-or-longer session_key. It cannot derive the client random key from material encrypted for a real Siemens PLC without the corresponding private key, so this gives tests and emulator users matching negotiated key material.

Dependency

#775 has merged. This branch now includes current master via a merge commit and targets master directly.

Validation

• uv run --frozen pre-commit run --all-files
• uv run --frozen pytest -q (1824 passed, 78 skipped)
• focused V3/server/TLS tests (119 passed)
• uv build --no-sources

Fixes #803

[gijzelaerr]

@bvanelli Could you review the V3 framing boundary here, particularly the HMAC input, response IntegrityId placement, and the emulator's explicit session-key setup? This is emulator-focused, so I am looking for a protocol review rather than another PLC capture.

The refreshed head is based on current master and passes 1,824 tests plus the full pre-commit and build checks.

[bvanelli]

I know it's not relevant, and it is personal preference, but this test reinforces what _verify_v3_hmac already does. For a real immutable test I would take a Wikipedia example, because it is verifiable.

[gijzelaerr]

Good point about making fixtures independently inspectable. This test does use Python stdlib hmac.new to produce the expected digest, so it is not only comparing our two verifier implementations to each other. I will keep the existing fixture in this focused PR; a published fixed vector would still be a useful follow-up if we expand the low-level HMAC tests.