[nealrichardson]

Closes #29.

with-connect used rsconnect-python only to sign a bootstrap JWT and POST it to Connect. This PR does both with the standard library (hmac, hashlib, base64, json, urllib), so docker is now the only dependency. The lockfile drops rsconnect-python and its transitive dependencies, including uv, pip, click, pyjwt and semver.

It also removes the circular dependency: testing changes to rsconnect-python no longer depends on rsconnect-python's own bootstrap code working.

Behavior kept from rsconnect-python

• JWT claims: the token still sends iss: "rsconnect-python", aud: "rsconnect" and scope: "bootstrap". Connect hard-codes these and rejects anything else (src/connect/api/bootstrap/bootstrap.go), and it also requires iat and exp. The header and claims are the same as rsconnect.json_web_token.TokenGenerator.bootstrap() produces, and the token verifies under pyjwt.
• Endpoint fallback: it tries v1/bootstrap first and falls back to v1/experimental/bootstrap on a 404, matching Use v1 bootstrap endpoint, falling back to experimental rsconnect-python#879. Connect versions before 2024.05.0 only have the experimental endpoint.

Other changes

• On failure, the container logs are printed once. Before, they could be printed twice.
• New unit tests cover JWT construction and signing, the v1 request, the 404 fallback, and that other HTTP errors are raised without falling back.

The test-versions CI matrix from #66 runs real Connect containers from 2022.10.0 through preview, covering both endpoints.

🤖 Generated with Claude Code