Add type checking (#3668)

* Fix ty type checker errors to make `make lint` pass

Add `ty` type checker to the lint pipeline and resolve all errors across
the codebase using inline `# type: ignore` suppressions, TYPE_CHECKING
guard patterns, and a `_StorageMixin` base class for storage test mixins.
Also fixes a latent bug: `settings.update(extras or None)` → `extras or {}`.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix ty type checker warnings to make \`make lint\` pass cleanly

- Replace deprecated \`codecs.open()\` with \`open()\` and \`tempfile.mktemp()\`
  with \`NamedTemporaryFile(delete=False)\`
- Suppress \`unsupported-base\` warnings on colander/zope.interface subclasses
  where ty cannot resolve the metaclass-based MRO
- Suppress \`possibly-missing-attribute\` warnings on \`sqlalchemy.exc\` accesses
  via the optional \`sqlalchemy\` module reference
- Remove two stale \`# type: ignore[attr-defined]\` comments in openapi support

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix CORS broken by instance attrs shadowing class attrs set by init_from_settings()

Instance-level `self.cors_origins = []` in `__init__` shadowed the class-level
`cls.cors_origins` set by `init_from_settings()`, causing all Service instances
to have empty cors_origins and disabling CORS entirely.

Replace instance attribute initializations with class-level type annotations
(no assignment), which satisfy ty without interfering with the class attribute
lookup in get_arguments().

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Make sure tag is used in package version (#3665)

Upgrade docutils and Sphinx (#3664)

Ref #360: Add a counters plugin to ease storage inspection (#3651)

* Add a counters plugin to ease storage inspection

* Fix test

* Update docs/api/1.x/counters.rst

Co-authored-by: Alex Cottner <148472676+alexcottner@users.noreply.github.com>

---------

Co-authored-by: Alex Cottner <148472676+alexcottner@users.noreply.github.com>

Fix purge_deleted() to only delete tombstones on PostgreSQL backend (#…

…3644)

The purge_deleted() method's base class contract and docstring specify
that it deletes "tombstones" (soft-deleted objects). The memory backend
correctly operates only on tombstone storage (self._cemetery). However,
the PostgreSQL backend's DELETE queries lacked a deleted = TRUE filter,
meaning purge_deleted with a before timestamp or max_retained would
delete both live records and tombstones.

This can result in silent data loss when running the purge_deleted
maintenance script.

What changed:
- Added AND deleted = TRUE to the before-path DELETE query
- Added WHERE deleted = TRUE to the max_retained-path CTE so the
  ranking window only considers tombstones
- Added three test cases that create live records + tombstones, call
  purge_deleted, and verify only tombstones are removed

Test coverage:
- test_purge_deleted_with_before_only_deletes_tombstones: Tests the
  before parameter path with mixed live/deleted objects
- test_purge_deleted_with_max_retained_only_affects_tombstones: Tests
  the max_retained parameter with 3 live + 5 tombstones
- test_purge_deleted_without_before_only_deletes_tombstones: Tests
  purging all tombstones while preserving live records

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

Import Redis cache backend from defunkt kinto-redis (#3638)

* Import Redis cache backend from defunkt kinto-redis

* Pin setuptools

* pin setuptools in docs too

* Fix redis import

Bump the minor-patch group with 3 updates (#3637)

Bumps the minor-patch group with 3 updates: [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy), [newrelic](https://github.com/newrelic/newrelic-python-agent) and [playwright](https://github.com/microsoft/playwright-python).


Updates `sqlalchemy` from 2.0.45 to 2.0.46
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `newrelic` from 11.3.0 to 11.4.0
- [Release notes](https://github.com/newrelic/newrelic-python-agent/releases)
- [Commits](newrelic/newrelic-python-agent@v11.3.0...v11.4.0)

Updates `playwright` from 1.57.0 to 1.58.0
- [Release notes](https://github.com/microsoft/playwright-python/releases)
- [Commits](microsoft/playwright-python@v1.57.0...v1.58.0)

---
updated-dependencies:
- dependency-name: sqlalchemy
  dependency-version: 2.0.46
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-patch
- dependency-name: newrelic
  dependency-version: 11.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
- dependency-name: playwright
  dependency-version: 1.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Fixing performance regression in all_resource_timestamps for postgres (…

…#3631)

Fix purge-delete committing (#3618)

Add new snapshot view in history plugin (#3601)

* Add new snapshot view in history plugin

* Check permissions

* Add missing OpenAPI docs