feat: add delete and delete_trace; drop preview language (1.1.0)

[rferreira]

Two things, in two commits.

1. delete / delete_trace (549efe9)

Propagates the openapi v2.2 delete endpoints (scanii/openapi#46, superseded by #48). The Aug 30 spec change split what was originally a cascading delete — the two resources are independent:

• DELETE /v2.2/files/{id} — removes the processing result only
• DELETE /v2.2/files/{id}/trace — removes the trace only

A customer deleting a result must not assume the findings went with it.

• ScaniiClient.delete(id) -> bool
• ScaniiClient.delete_trace(id) -> bool
• Both raise ScaniiError on 404 (which is also what a repeated delete of the same id returns) and ScaniiAuthError on 401/403, via the existing _raise_for_status
• Version 1.0.1 → 1.1.0 in both pyproject.toml and src/scanii/_version.py, kept in sync per CLAUDE.md §6

bool mirrors scanii-java and matches this SDK's existing delete_auth_token, so parity and local convention agree.

2. Drop the "v2.2 preview" language (416cf10)

Docs only — no behavior, signature or return-type change.

The spec only ever marked GET /files/{id}/trace as preview; process_from_url was listed as a plain 2.2 feature, so labelling it preview was drift from the v2.2 propagation. The trace endpoint's marking is being dropped from the contract too — scanii/openapi#49.

• Removed the preview paragraph from retrieve_trace() / process_from_url() docstrings and the ScaniiTraceResult model docstring
• Folded the README's "v2.2 preview methods" section into the file-scanning table; both are now ordinary rows
• Historical CHANGELOG entries left intact as a record of what shipped; 1.1.0 notes the change

The other 7 SDKs carry the same preview language and need the same sweep — tracked separately.

Tests

6 integration tests against scanii-cli hard-asserting the split (new surface → no self-skip): result deleted while trace survives; trace deleted while result survives; repeated delete raises; unknown id raises for both; empty id raises ValueError.

9 unit tests for what integration can't isolate: HTTP verb, exact path, id url-encoding, and 404/403 error mapping. The 403 case (temporary auth tokens aren't privileged to delete) is covered deterministically here.

Verification

All four CI gates locally on Python 3.14.4 against scanii-cli v1.12.0:

• pytest — 86 passed, 0 skipped (confirmed the integration tests genuinely ran rather than self-skipping)
• mypy src (strict) — clean, 7 source files
• ruff check — clean
• python -m build — builds scanii_python-1.1.0

Plus a consumer-install smoke test, since CI never installs the artifact the way a customer does (the scanii-go lesson): built the wheel, installed into a clean venv, and ran the split flow from site-packages rather than the source tree — delete_trace → trace gone, result intact; delete → result gone.