refactor: modularize client, fix remittanceInfo parser, verify API against production

Split the monolithic client into focused modules (http_api, auth_flow,
remittance, client) with minimal coupling. Public API unchanged — all
existing callers continue to work.

Remittance parser rewrite (Verwendungszweck):
  - Old heuristic parser replaced with verified 37-char (BOOKED) and
    35-char (NOTBOOKED) window rules.
  - Per-chunk normalization collapses runs of whitespace (LL  LU → LL LU).
  - SEPA labels (End-to-End-Ref.:, CORE / Mandatsref.:, Gläubiger-ID:)
    now extracted into dedicated fields on the new ParsedRemittance.
  - Chunks are never concatenated across windows, matching web UI behavior.
  - Tests updated with real API samples captured from the live account.

Bug fixes:
  - _clear_tokens now removes both in-memory tokens and the persisted file
    (previously stale tokens survived failed refreshes).
  - Token storage writes atomically via temp file + os.replace with 0600
    permissions set from creation.
  - _ensure_fresh_token refreshes proactively using the same threshold as
    the background task, avoiding 401-then-retry on boundary cases.
  - Non-push TAN types (P_TAN, M_TAN) now raise AuthenticationError with
    a clear message instead of crashing with KeyError: 'link'.
  - Removed the deptor fallback — live API consistently uses debtor.
  - Background refresh task is awaited during close() to avoid pending-task
    warnings.
  - reauth_callback now supports both sync and async callbacks.

API additions (non-breaking):
  - Transaction.remittance property → ParsedRemittance
  - Transaction.remittanceInfo exposes the raw API string
  - get_transactions() gains min_booking_date, max_booking_date,
    paging_first, paging_count parameters
  - fetch_all_booked_transactions() walks >500 transactions using the
    BOOKED + min-bookingDate + paging-first strategy from COMDIRECT_API.md

Documentation:
  - New COMDIRECT_API.md with live-verified API behavior, including:
    pagination rules, transactionType enum values, BusinessMessage error
    format, revoke endpoint, TAN lockout thresholds, full remittanceInfo
    parsing algorithm with verified test cases.

Cleanup:
  - Removed BDD/gherkin files (comdirect_api.feature, test_comdirect_bdd.py,
    TEST_COVERAGE.md, pytest-bdd dependency).
  - Removed unused pydantic dependency.
  - Removed debug JSON-dump from test_api_operations.py that was writing
    files into CWD on every test run.
  - .gitignore now covers .claude/, test.sh, and transactions*.json.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: mcdax

.gitignore

@@ -138,3 +138,14 @@ dmypy.json
 # Token storage files
 tokens.json
 tokens/
+
+# Claude Code workspace
+.claude/
+
+# Local credential / test scripts
+test.sh
+
+# Example output artifacts
+transactions.json
+transactions_parsed.json
+transactions_with_nulls.json