improve: add PEP 561 type markers, sanitize git credentials, dynamic UI version

[m2papierz]

Summary

Three quality improvements:

1. PEP 561 compliance - adds py.typed marker files to all 8 packages
2. Security - sanitizes git remote URLs in provenance capture to prevent accidental credential/token leakage
3. Maintenance - uses importlib.metadata for UI version instead of hardcoded string

Type of change

• Bug fix
• New feature
• Refactor (no user-facing change)
• Docs only
• CI/build tooling
• Breaking change

Checklist

• I ran lint locally (uv run pre-commit run --all-files)
• I ran tests locally (uv run pytest)
• I added/updated tests for behavior changes
• I updated docs/README/examples if needed
• If I changed dependencies, I updated uv.lock (uv lock) and committed it
• I considered backward compatibility and security impact