feat!: bundle cryptography in release binaries and modernize deps

[mkb79]

Aligns audible-cli with the freshly released audible 0.11.0 and gives the prebuilt binaries the Rust-accelerated cryptography backend.

Version stays at 0.3.3 here; the CHANGELOG entries live under Unreleased. The Release version 0.4.0. commit + tag is a separate follow-up (mirroring how 0.3.3 was cut).

Dependencies

• Python: >=3.10,<3.14 → >=3.11,<3.15 (drop 3.10, add 3.14)
• audible: >=0.8.2 → >=0.11.0
• httpx: >=0.23.3,<0.28.0 → >=0.27.2,<0.29 (identical to audible; resolves to httpx 0.28.1)
• Raised minimums: aiofiles, click, Pillow, tabulate, tqdm, questionary, packaging, colorama
• New optional extra [cryptography] → audible[cryptography]>=0.11.0 (enables audible's Rust-accelerated crypto provider)
• ruff target py311, mypy python_version = "3.11", CI PYTHON_VERSION 3.14

Binaries bundle cryptography (statically linked)

All six build.yml targets now build with the extra + collect flags:

uv run --extra cryptography pyinstaller … --collect-all cryptography --collect-submodules audible.crypto_provider …

Verified locally (Linux/3.14): the real audible onefile binary builds, runs in a clean environment (env -i, no Python/venv), reports CryptographyProvider, and performs AES/SHA256 via the bundled backend. PyInstaller's hook confirms cryptography does not seem to be using dynamically linked OpenSSL — OpenSSL is statically embedded, so the binary stays portable. macOS/Windows validate on the tag build (their cryptography wheels bundle OpenSSL the same way).

Docs

• README: [cryptography] extra install instructions + note that prebuilt binaries already bundle it statically
• CHANGELOG: Unreleased entries (deps + extra + binaries); fixed the broken # Added / ##} Changed headers

Notes

• JSON providers intentionally left untouched.
• ruff reports pre-existing lint debt (no ruff CI); out of scope, not touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ax6YU6ei3uniE6sQ5GPeVR