fix: v2.5.1 security/ML/reliability patch

Security:
- H1 DNS rebinding TOCTOU: validate_endpoint returns (endpoint, resolved_ips);
  create_pinned_session builds an aiohttp session with a custom resolver that
  returns only the pre-validated IPs, closing the re-resolve gap.
- H2/M3 Shared session cookie pollution: integration no longer uses HA shared
  clientsession; isolated session with DummyCookieJar prevents cross-integration
  cookie leaks.
- Cloud metadata / link-local block added to allow_local_network mode to
  prevent IMDS exfiltration on cloud VMs.
- L3 hard cap extended to history.async_get_history (not only service schema).

ML/LLM correctness:
- _is_openai_reasoning_model uses regex with gpt-5-chat* blacklist and handles
  OpenRouter-style openai/ prefix. Future o5/gpt-6 auto-recognized.
- reasoning_effort=minimal for gpt-5 family, low for o-series.
- Gemini 2.5 Pro gets thinking_budget=128 (Pro rejects 0, flash accepts 0).
- Anthropic extracts first type=text block instead of hardcoded content[0].
- /no_think dedup uses word-boundary regex instead of substring.
- DeepSeek-reasoner detected: skips /no_think; preserves reasoning_content.

Reliability:
- Exception chaining added to Gemini-block re-raises.
- Top-level imports for json/re/hashlib (no more lazy stdlib imports).
- allow_local_network logged at INFO, not WARNING on every setup.

Code style:
- PEP 604 type hints across all .py files (dict/list/| None).

No breaking changes for users. Internal API: validate_endpoint return type
changed from str to tuple[str, list[str]].

custom_components/ha_text_ai/providers.py

@@ -62,7 +62,6 @@ PROVIDER_REGISTRY: dict[str, dict[str, Any]] = {
     },
 }
 
-
 def get_provider_config(provider: str) -> dict[str, Any]:
     """Get full provider configuration.
 
@@ -73,17 +72,14 @@ def get_provider_config(provider: str) -> dict[str, Any]:
         raise ValueError(f"Unknown API provider: {provider}")
     return PROVIDER_REGISTRY[provider]
 
-
 def get_default_endpoint(provider: str) -> str:
     """Get default API endpoint for a provider."""
     return get_provider_config(provider)["default_endpoint"]
 
-
 def get_default_model(provider: str) -> str:
     """Get default model for a provider."""
     return get_provider_config(provider)["default_model"]
 
-
 def build_auth_headers(provider: str, api_key: str) -> dict[str, str]:
     """Build authentication headers for a provider."""
     config = get_provider_config(provider)