Prepare the 1.0.0 release

[artpods56]

Summary

• Collects the local 1.0.0 preparation commits onto codex/1-0-0-release on top of current main.
• Adds the new SDK public-surface work: resumable auth/session state, refreshable certificates, simpler invoice filters, FA(3) builder, public model facade, docs restructure, and README CLI example fixes.
• Repairs clean release checks so GitHub Actions enforces the configured basedpyright error gate without failing on the existing warning backlog.

Verification

• UV_PYTHON=3.12 just release-check
• UV_PYTHON=3.13 just release-check
• GITHUB_ACTIONS=true UV_PYTHON=3.13 just release-check
• GitHub checks on PR Prepare the 1.0.0 release #84: ci (3.12), ci (3.13), coverage, and validate all pass.

Release closeout before stable 1.0.0

• Bump package metadata from 0.19.0 to 1.0.0 via the existing commitizen/version-file flow, including pyproject.toml and src/ksef2/__version__.py.
• Finalize the draft 1.0.0 release notes and migration docs in both EN/PL, then remove the draft cautions once the tag is ready.
• Make the deprecation/removal horizon explicit for compatibility APIs: Client.authenticated(), AsyncClient.authenticated(), session get_state(), sensitive dump aliases, legacy session-state models, and BatchSessionClient.access_token.
• Decide whether the FA(3) builder draft API names dump_state() / dump_state_json() / from_state() stay stable for 1.0 or get a final naming pass before the freeze.
• Confirm the README “100% endpoint coverage” wording remains clearly about OpenAPI route coverage, not unit-test line coverage; current badges are 73 / 73 (100%) API coverage and 82% unit-test coverage.
• Run credentialed TEST/DEMO integration tests before undrafting; current PR verification is unit/runtime/build/docs/codegen, not live KSeF workflows.
• Confirm generated XML under local scripts/downloads/ is either deleted locally or ignored intentionally; it is not part of this PR because it contains generated test workflow output.
• Confirm final OpenAPI target remains 2.6.1 immediately before tagging by rerunning just fetch-spec, just sync-ksef-api-version, and just check-gen-sync if the Ministry publishes another schema update.