fix(M10): apply FIXME_M10 corrections (transport, dry_run, format, security)

Fix all 8 findings from the independent review (FIXME_M10.md):

#1 Transport compatible with slixmpp 1.17.0 (D5):
  - Use real ClientXMPP type (remove Any), JID with resource
  - connect(host, port) explicit, no use_tls kwarg
  - enable_direct_tls/enable_starttls configured before connect
  - Single timeout via asyncio.Future for session_start/failed_auth/disconnected
  - Remove premature 'starttls' in features check, remove auto_reconnect
  - try/finally guarantees disconnect on all paths (#4)

#2 Factory dry_run no longer bypassed (D6):
  - Single send() entry point in SyncXmppChannel
  - dry_run check before any ClientXMPP creation
  - Remove XmppChannel.send() dual implementation

#3 Thread daemon removed — single asyncio.run(), documented limitation

#5 Richer message format:
  - Target date header, change type [Ajouté/Supprimé/Modifié]
  - Lesson times, homework due date, message author
  - No pronote_messages duplication (external_info = blog + other_info only)

#6 Error contract unified (D6):
  - Channel.send() -> bool never raises PipelineWarning
  - Errors logged with redaction, returns False
  - PipelineWarning(step='xmpp') will be created by pipeline M11

#7 Tests faithful to slixmpp 1.17.0 API:
  - FakeClientXMPP with real connect(host,port)/disconnect() signatures
  - Assertions on host, port, resource, mtype='chat'
  - No RuntimeWarning from unawaited coroutines

#8 .secrets.baseline restored from main

Coverage: 96.44% on channels/, 600 tests pass, pre-commit all-files green.

Co-authored-by: opencode/coder <coder@agents.invalid>
Co-authored-by: opencode/test-engineer <test-engineer@agents.invalid>

tests/unit/test_xmpp_factory.py

@@ -19,6 +19,7 @@ Spécification (D2) :
 from __future__ import annotations
 
 from typing import Any
+from unittest.mock import patch
 
 import pytest
 from pydantic import SecretStr
@@ -286,6 +287,26 @@ class TestGetChannelDryRun:
         assert result is not None
         assert isinstance(result, Channel)
 
+    def test_get_channel_dry_run_no_connection(self) -> None:
+        """Vérifie que dry_run=True ne crée pas de ClientXMPP.
+
+        :return: None
+        :rtype: None
+        """
+        settings = XmppSettings(
+            enabled=True,
+            jid="bot@example.com",
+            password=SecretStr("pass"),
+            host="example.com",
+            to="parent@example.com",
+        )
+        with patch("pronote_sync.channels.xmpp.ClientXMPP") as mock_cls:
+            result = get_channel(settings, dry_run=True)
+            assert result is not None
+            assert isinstance(result, Channel)
+            # ClientXMPP ne doit pas être instancié en dry_run
+            assert not mock_cls.called
+
 
 class TestChannelImportsFromInit:
     """Tests pour vérifier que les exports depuis __init__.py fonctionnent."""