Release 3.2.1: keep the signing key out of the malformed-JWK error

[vvillait88]

Summary

Maintenance sweep for python-commerce, released as 3.2.1 because it carries one fix to shipped code (the Python mirror of node-commerce 3.1.2).

Fix: the signing key no longer travels with the malformed-JWK error. load_ucp_signing_key_from_env raised its "is not valid JSON" ValueError from the JSONDecodeError, and that error keeps the whole input in .doc, which here is the private JWK. Anything that records chained exceptions (an error tracker, a traceback with locals) received the key. The error now names the variable only and raises from None.

Sweep:

• Relocked to current: fastapi 0.146.0, starlette 1.9.0, cdp-sdk 1.50.0, joserfc 1.7.7, pydantic-settings 2.16.0, httpx2 and httpcore2 2.14.0, ruff 0.17.1, ty 0.0.89, plus certifi, pluggy, wrapt, truststore, bitarray and lefthook. The only prereleases in the lock are the three OpenTelemetry packages that have never shipped a stable release, unchanged from main.
• The uv pin in ci, publish and security moves from 0.13.0 to 0.13.1.
• The lint and type gate job runs on Python 3.15 (uv sync --python 3.15, so the job uses that interpreter rather than whichever one uv finds first), and so does the pip-audit job. The test matrix still covers 3.11 through 3.15.

Worked with Varun, as part of a three-session maintenance sweep.

Not done, on purpose: the web3<8 constraint stays. Its lift condition was re-tested: pympp 0.14.0 still requires eth-abi<6 in both its tempo and stripe extras. Optional-extra floors are unchanged, since the published ranges already admit the new versions.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

The malformed-JWK error's message is now UCP_SIGNING_KEY_JWK_PRIVATE is not valid JSON. (or the configured variable name) without the decoder's position detail, and it no longer chains the JSONDecodeError. The exception type is unchanged.

Test plan

A new test feeds a malformed value and asserts the message carries no part of it, __cause__ is None and the context is suppressed. It fails against the previous ucp_jwks.py and passes with the fix. Run locally on Python 3.15: ruff check, ruff format --check, ty (package and examples), vulture and pytest (1674 passed, 4 skipped), each exit 0. osv-scanner 2.7.0 over uv.lock reports no issues across 164 packages.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
• No secrets, credentials, or personal data in the diff or the tests