feat(protocol): add bounded Block1 POST uploads

[Jason-Morcos]

Summary

• keep POST bodies through 1024 bytes on the existing fix(protocol): retransmit and fail fast on the write path #54 single-frame attempt loop
• route larger bodies into Block1 before allocating an ordinary POST exchange
• upload larger bodies with one token, one shared-registry MID per logical block, byte-identical per-block retransmission, and Size1 on the first block
• honor a server-requested smaller block size by byte offset
• keep URI queries and extension options on every block
• reject incomplete, contradictory, oversized, or unbounded transfers with typed errors

Why

This implements the Block1 path used by my working Home Assistant integration for the local washer/dryer connection flow. The transport keeps each block as its own confirmable CoAP exchange instead of relying on one oversized request being reconstructed across DTLS application-data records.

I do not currently have a shareable A/B capture of the same oversized body failing without Block1 and succeeding with Block1. QuiteYellow offered to run that comparison on a dryer and oven in the review; that remains the hardware gate before merge.

This PR adds only the transport primitive. The credential or ownership payload that a caller may send, and any decision to perform that write, remain outside this change.

Current base and retry behavior

This branch is restacked on #49 and the merged #54/#57/#58 substrate. Bodies through 1024 bytes still use the #54 ordinary POST loop unchanged. A larger body branches before an ordinary token, MID, or pending exchange is allocated.

Each Block1 chunk registers once in the shared token/MID registry, reuses one encoded datagram across its bounded retries, stops retransmitting after an empty ACK, surfaces RST by MID, and waits through _wait_live. The Block1 retry count is independent of write_max_attempts.

The Block1-only commit is 1f5b959.

Stack / merge order

1. feat(protocol): validate GET and POST request options #48: validated query and extension options
2. feat(protocol): add CoAP DELETE requests #49: DELETE
3. feat(protocol): add bounded Block1 POST uploads #50 (this PR): bounded Block1 POST uploads

Merge #50 after #49.

Validation

• 490 SmartThings-Local tests against this exact head
• all 1,730 LocalThings tests at b5e25d7 against this exact source tree
• exact and partial boundaries, size downshift, stale responses, byte-identical retransmission, response-during-pace, empty ACK, RST, reader teardown, per-attempt deadlines, builder-failure cleanup, request cap, and payload cap
• current Home Assistant request behavior compared against the working integration; its 55 focused transport/resilience tests pass
• wheel and sdist content checks plus isolated install/import smoke tests
• bytecode compilation and share-safety checks
• all eight GitHub jobs pass on this exact head, including Python 3.11-3.14, dependency-floor/latest, package, and share safety

[QuiteYellow]

Not reviewed yet, same as #48. #56 holds the order.

The claim I want to confirm on hardware before this lands is the motivating one: that Samsung's IoTivity server will not reconstruct an oversized CoAP message split across DTLS application-data records, so a body over one 1024-byte block needs Block1 framing with a stable token. If you have a capture of the failure without Block1, link it. I have a dryer and an oven I can try it against.

Like #49 this stays on the transport side of #28. Block1 framing is a primitive; the credential and ownership payloads that motivate it are a separate question.