feat: v0.3.0 — review welle 2 (M-4, M-5, M-6)

Three resilience and honesty fixes from the v0.2.8 review. Minor
version bump because redeploy_project and system_prune return
different strings.

M-4: trigger_build_stream now converts every non-ReadTimeout
httpx.HTTPError (ConnectError, ConnectTimeout, WriteError,
RemoteProtocolError, ...) into a SynologyError with a clear
message. Previously only ReadTimeout was handled; everything else
propagated as a raw httpx exception. redeploy_project now tracks
whether stop was actually issued and, when build_stream fails after
a successful stop, tells the user the project is in STOPPED state
and recommends start_project / retry rather than the misleading
"use stop + start separately" workaround.

M-5: _wait_for_project_running exits early on BUILD_FAILED / ERROR
(new _TERMINAL_FAILURE_STATUSES frozenset). DSM signals these
statuses within seconds of a failed image pull; the old polling
loop kept waiting up to 5 minutes for RUNNING. redeploy_project
now surfaces the terminal status with a BUILD_FAILED-specific hint
to update_image_tag.

M-6: system_prune preview now enumerates user-created networks
that have no containers attached (excluding the three built-in
networks bridge/host/none, which Docker never prunes). Previously
the preview noted "Unused networks: (not counted)" even though
SYNO.Docker.Utils/prune does delete them — users could lose
networks they had not been warned about.

Tests:
- 2 new dsm_client tests: ConnectError and RemoteProtocolError
  both raise SynologyError, not raw httpx exceptions.
- 2 new project tests: recovery hint after stop+build_stream
  failure (RUNNING case); old workaround retained for the
  STOPPED case where no stop was issued.
- 3 new polling tests: BUILD_FAILED and ERROR each trigger early
  exit; redeploy_project surfaces BUILD_FAILED with update_image_tag
  hint.
- 2 new system_prune preview tests: counts unused networks
  correctly, excludes built-ins; network-fetch failure is non-fatal.

245 tests pass. ruff check + ruff format clean.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

tests/test_dsm_client.py

@@ -563,6 +563,46 @@ async def test_build_stream_read_timeout_swallowed() -> None:
         assert result is None
 
 
+@pytest.mark.asyncio
+async def test_build_stream_connect_error_raises_synology_error() -> None:
+    """M-4: ConnectError (DSM unreachable) must surface as SynologyError, not raw httpx."""
+    async with DsmClient(base_url="https://nas.local:443") as client:
+        mark_initialized(client)
+        client._http = AsyncMock()
+
+        ctx = MagicMock()
+        ctx.__aenter__ = AsyncMock(side_effect=httpx.ConnectError("nas offline"))
+        ctx.__aexit__ = AsyncMock(return_value=None)
+        client._http.stream = MagicMock(return_value=ctx)
+
+        with pytest.raises(SynologyError) as exc_info:
+            await client.trigger_build_stream("proj-1")
+
+        msg = str(exc_info.value)
+        assert "transport error" in msg
+        assert "ConnectError" in msg
+        # Cause is suppressed via `from None` to keep error message clean.
+        assert exc_info.value.__cause__ is None
+
+
+@pytest.mark.asyncio
+async def test_build_stream_remote_protocol_error_raises_synology_error() -> None:
+    """M-4: RemoteProtocolError (broken response framing) is also converted."""
+    async with DsmClient(base_url="https://nas.local:443") as client:
+        mark_initialized(client)
+        client._http = AsyncMock()
+
+        ctx = MagicMock()
+        ctx.__aenter__ = AsyncMock(side_effect=httpx.RemoteProtocolError("server disconnected"))
+        ctx.__aexit__ = AsyncMock(return_value=None)
+        client._http.stream = MagicMock(return_value=ctx)
+
+        with pytest.raises(SynologyError) as exc_info:
+            await client.trigger_build_stream("proj-1")
+
+        assert "RemoteProtocolError" in str(exc_info.value)
+
+
 @pytest.mark.asyncio
 async def test_build_stream_http_500_scrubs_sid() -> None:
     async with DsmClient(base_url="https://nas.local:443") as client: