feat: receive published blog articles

[alihesari]

What

• article_router(secret=..., on_article_published=...): an APIRouter the developer includes with app.include_router(...). It reads await request.body(), verifies through the parent's fopost.webhooks.verify (X-FoPost-Signature-256 over timestamp.body, 300 s tolerance), answers 401 on a bad or stale signature, {"ok": true} for article.test, and hands article.published to the callback as a typed ArticlePublishedPayload. The callback may be sync (run in a worker thread) or async, and a returned URL string is echoed as {"url": "..."}. Nothing else is registered.
• client.blog needs no wrapper code: FoPostDep already injects the parent client, so fopost.blog.* is reachable as-is. README mentions it.
• README section "Receive blog articles", CHANGELOG under Unreleased, CLAUDE.md architecture note. No version bump, no tag.

Parent pin

The parent fopost gains the blog resource and verifier on feature/blog-articles (fopost/fopost-python#32), unreleased. pyproject.toml now declares fopost>=0.3,<1.0, and CI installs the parent from that git branch in a step before pip install -e '.[dev]'. Once fopost 0.3 is on PyPI, drop that CI step; the floor already points at the release.

Merge order: fopost-python#32, then release fopost 0.3, then this.

How to verify

pip install 'fopost @ git+https://github.com/fopost/fopost-python@feature/blog-articles'
pip install -e '.[dev]'
ruff check . && ruff format --check . && mypy && pytest

tests/test_articles.py: a signed article.test is accepted, a tampered article.published is 401 and the callback never runs, a signed article.published reaches the callback parsed and its URL is echoed, a sync callback works.