Modernize integration for current Home Assistant APIs

Tracking issue for adopting current HA integration patterns, targeted at 0.9.0 (after 0.8.0 stabilises — none of these are user-visible, so they shouldn't churn the MFA beta).

Verified state as of HA 2026.7.2: the integration runs cleanly (no deprecation warnings, no tracebacks), so this is modernization rather than fixing breakage. `hacs.json` now declares the 2025.1 floor and CI (#90) tests both ends of the range.

## Config flow
- [x] Replace `FlowResult` (from `homeassistant.data_entry_flow`) with `ConfigFlowResult` from `homeassistant.config_entries` — the old alias still imports but is deprecated
- [ ] Use `self._get_reauth_entry()` instead of manual `self.hass.config_entries.async_get_entry(self.context["entry_id"])`

## Runtime data
- [ ] Move `hass.data[DOMAIN][entry.entry_id]` (client + coordinator) to `entry.runtime_data` with a typed `EvnexConfigEntry = ConfigEntry[...]` alias; drop `DATA_CLIENT`/`DATA_COORDINATOR` keys
- [ ] Subclass `DataUpdateCoordinator` properly instead of constructing it with a closure `update_method` — makes the retry/auth handling testable

## Auth (depends on python-evnex 0.7.0)
- [ ] Adopt the `EvnexAuth`/`TokenSet` API from hardbyte/python-evnex#113 when released: token-persistence callback replaces the poll-time `_async_persist_tokens` check, resumption stops requiring the stored password, and MFA challenge objects replace the pycognito exception types in `config_flow.py`
- [ ] Consider dropping the stored password from config entry data entirely (reauth collects it interactively anyway)

## CI/workflow hygiene
- [ ] `actions/checkout@v2`/`@v3` → `@v6` in the hassfest/lint jobs; drop the pip cache step (uv handles it)
- [ ] Review Dependabot security alerts — mostly transitive pins in `uv.lock` (dev-only); the deps refresh in #88 already reduced them 77 → 71
- [ ] Add a coordinator/setup test (entry migration 1.2→1.3, `ConfigEntryAuthFailed` → reauth) to the suite from #90

## Hassfest warnings
- [ ] `CONFIG_SCHEMA`: the vestigial `async_setup` (returns True) triggers a hassfest warning — use `cv.config_entry_only_config_schema(DOMAIN)` or remove `async_setup` entirely

The checklist names config_flow.py, hassfest/lint jobs, uv.lock, and the coordinator/setup suite from #90. Start by splitting out one unchecked item, then read the relevant existing implementation and run the suite or workflow it names. Done means the selected modernization is implemented, its tests pass, and the corresponding warnings or deprecated patterns are gone.

Written by the indexing model from the issue text.