Add proof-measure client + Gitea PyPI publish; bump to 0.4.0

proof-measure is a separate, public, unauthenticated Dragonchain service. Adds:
- UnauthenticatedClient: HMAC-free transport mirroring Client (session
  injection, allow_redirects=False, from_dict decoding).
- ProofMeasureClient: get_security / report / health; default base URL
  https://proof-measure.dragonchain.com. Standalone (ProofMeasureClient()) and
  via DragonchainSDK.proof_measure.
- Proof-measure dataclass models (decimals as strings, timestamps as int).
- .gitea/workflows/publish.yml: build + twine upload to the Gitea PyPI registry
  on release (the SDK had no publish workflow before).

Also fixes 3 pre-existing failing tests: _FakeSession.request didn't accept the
allow_redirects kwarg the client now passes (added by the prior redirect change),
so the suite was red at HEAD.

README.md

@@ -146,6 +146,45 @@ client = DragonchainSDK(
 ### Block
 - `block.get(block_id)` — Get block by ID
 
+### Proof Measure (public, unauthenticated)
+- `proof_measure.get_security(network, since=None)` — A network's accumulated security since `since` (unix seconds), as a raw measure + USD valuation. `network` = `"BTC"` or `"ETH"`.
+- `proof_measure.report(req)` — Per-transaction "securedBy" report over interchain anchors.
+- `proof_measure.health()` — Service liveness.
+
+## Proof Measure
+
+`proof-measure` is a separate, **public, unauthenticated** Dragonchain service
+(the measured-immutability / "securedBy" metric) at
+`https://proof-measure.dragonchain.com`. It needs no credentials. Decimal fields
+are returned as strings (full precision) and timestamps as int unix seconds.
+
+```python
+import time
+from prime_sdk import ProofMeasureClient, ReportRequest, ReportAnchorInput
+
+# Via the main SDK (targets the default public endpoint):
+sec = client.proof_measure.get_security("BTC", int(time.time()) - 3600)
+print(f"BTC secured by {sec.value_usd_formatted} ({sec.raw.value} {sec.raw.unit})")
+
+# Or standalone — no prime credentials needed:
+pm = ProofMeasureClient()  # or ProofMeasureClient("http://localhost:9481")
+
+report = pm.report(
+    ReportRequest(
+        transaction_id="tx-123",
+        prime_id="my-prime",
+        block_id="42",
+        anchors=[
+            ReportAnchorInput(tx_hash="0x...", timestamp=anchor_unix, network="BTC"),
+            ReportAnchorInput(tx_hash="0x...", timestamp=anchor_unix, network="ETH"),
+        ],
+    )
+)
+print(f"Secured by {report.total_value_usd_formatted} across {len(report.anchors)} anchors")
+
+pm.health()
+```
+
 ## Authentication
 
 The SDK uses HMAC-SHA256 authentication. You need to provide: