feat: provide settings through the container and derive engine URLs

[lesnik512]

Settings used to reach the engines through the module-level settings instance, so tests changed engine config with monkeypatch.setattr(settings, ...). This PR provides settings through the container and uses provider.derive (modern-di 4.3.0) for the engine URLs. It is the setup asked about in modern-python/.github#136.

Changes

• ioc.Config.settings is a cached Factory(Settings).
• create_sa_engine(*, settings, url, read_only=False) no longer reads the global. Both engines take the whole settings object. The primary engine gets its URL from Config.settings.derive(lambda s: s.db_dsn_parsed), and the read engine from Config.settings.derive(read_engine_url), which holds the replica fallback.
• create_primary_sa_engine and create_read_sa_engine are removed.
• The replica DSN tests now override Config.settings on a fresh container and check the read engine's URL. test_pool passes an explicit Settings(...) instead of monkeypatching.
• modern-di>=4.3.0,<5 is a direct dependency, and the lock moves modern-di from 4.0.0 to 4.3.0.
• AGENTS.md describes the settings provider.

Design notes

• Engines need about eight settings fields, so deriving each one would be noisier than passing the object. derive is used only for the value that differs between the two engines.
• The module-level settings stays for app/__main__.py, migrations/env.py and build_app, which run outside the container or before it exists. test_main keeps its monkeypatch. The container builds its own Settings from the same environment.
• Engines are cached at APP scope, so an override of Config.settings only affects engines built after it.

Testing

just test: 87 passed, 100% coverage. just lint is clean.