fix: correctness and dependency pass for 0.15.0

[NateShoffner]

Fixes seven bugs from an architecture review and clears the aiohttp advisories. One logical change per commit.

Breaking

• requires-python is now >=3.10. Clearing all 34 Dependabot alerts needs aiohttp 3.14.3, and no release both fixes them and supports 3.9. The last 3.9-compatible release would have left 14 open, 1 high.
• lcwc.agencies.exceptions removed. Nothing ever raised those exceptions, but the import was legal before.
• AgencyResolver.get_unit_agency removed. It raised AttributeError on every call.

Fixes

• The published package could not be imported. pydantic was never declared in pyproject.toml, so a clean install then import lcwc raised ImportError. Also swaps the bs4 placeholder for beautifulsoup4.
• One caller's agencies leaked into every client. AgencyResolver aliased the module-level roster instead of copying it.
• All clients shared one resolver. AgencyResolver() as a default argument is evaluated once at import. Now a None sentinel.
• Both parsers caught exceptions that are never raised. UnitParser sets the out_of_county and pending flags instead.
• The README example did not run. Wrong import, and a top-level async with.
• utils/unitconverter.py did not parse. Finished as a working abbreviation converter; not wired into the parsers yet.

Verification

Built the wheel, installed it clean, and ran all three clients against the live service. Ran the README snippet verbatim. Each of the nine commits imports and parses, so the history bisects. Suite passes, flake8 and black --check clean.

Confirmed restadapter.py's deprecated verify_ssl= still works in 3.14.3 before pinning. It should move to ssl= before a release removes it.

Supersedes #6.