build(deps): take every remaining package to its usable latest

[bgard68]

Supersedes #52, #53, #54, #55, #56, #57 and #37 — all seven went DIRTY when #49 landed, because every one edits the same project files. They were never independent, so rebasing seven branches would have re-created the same tangle.

Package	From	To
Microsoft.Extensions.Configuration.Abstractions	9.0.19	10.0.11
Microsoft.Extensions.DependencyInjection.Abstractions	9.0.19	10.0.11
Microsoft.Extensions.Options	9.0.19	10.0.11
Microsoft.Extensions.Options.ConfigurationExtensions	9.0.19	10.0.11
Microsoft.Extensions.TimeProvider.Testing	9.10.0	10.9.0
Microsoft.NET.Test.Sdk	17.14.1	18.9.0
Npgsql	9.0.5	10.0.1
dbup-postgresql	5.0.40	7.0.1
xunit.runner.visualstudio	2.8.2	4.0.0

The Extensions family moves together, on purpose

Splitting it is what broke #53. It took Options.ConfigurationExtensions to 10.0.11, which requires Options >= 10.0.11 — while Options itself was bumped in #52. Each half failed with NU1605 on its own branch, and neither could be merged first. They are one change wearing two PR numbers.

Microsoft.OpenApi is deliberately not bumped — #56 is unmergeable

NU1608: Microsoft.AspNetCore.OpenApi 10.0.11 requires
        Microsoft.OpenApi (>= 2.7.5 && < 3.0.0)
        but version Microsoft.OpenApi 3.10.0 was resolved

The 3.x line sits outside the range ASP.NET Core 10.0.11 will accept. 2.12.0 is the newest usable version, not merely the newest tried. That constraint lifts when ASP.NET Core ships a build referencing OpenApi 3.x — not before, and no rebase of #56 changes it. It should be closed, not retried.

Risk: the test runner crosses two majors

xunit.runner.visualstudio 2.8.2 → 4.0.0 fails by silently not discovering tests, not by failing to compile — so a green build proves nothing on its own. All 66 tests were run and pass on the new runner.

Verification

Local, on the 10.0.100 SDK: Release build clean, 0 warnings under TreatWarningsAsErrors, 66/66 tests pass.

🤖 Generated with Claude Code