Reconcile OpenAPI 3.31.0 spec drift (v16.0.0)

[TexasCoding]

Closes #519

Reconciles upstream OpenAPI 3.30.0 → 3.31.0 (plus matching perps OpenAPI / AsyncAPI updates). The nightly strict contract suite had grown from the 8 subaccount failures in #519 to 18 failures against today's upstream spec; this PR makes all of them pass and bumps to 16.0.0.

What changed

Added (non-breaking)

• historical.fills / fills_all / orders / orders_all (sync + async): optional subaccount= query param
• markets.list / list_all (sync + async): optional max_updated_ts=
• api_keys.generate(..., key_type=) ("rsa" / "ed25519"), GenerateApiKeyRequest.key_type, optional GenerateApiKeyResponse.key_type. KalshiAuth stays RSA-PSS only (documented).
• fcm.fills() / fcm.fills_all() for new GET /fcm/fills + FcmFill / GetFcmFillsResponse
• Perps fcm.update_notional_risk_limit() / delete_notional_risk_limit() for new PUT / DELETE /margin/fcm/notional_risk_limit + UpdateFCMNotionalRiskLimitRequest (extra="forbid"); never retried
• Perps FCMSubtraderNotionalRiskLimit; optional NotionalRiskLimitResponse.member_notional_value_risk_limit / effective_account_notional_value_risk_limit
• Literals widened for runtime safety: RestingMarginReservationLiteral += "none"; perps LastUpdateReason / LastUpdateReasonLiteral / WS PerpsLastUpdateReason += "ReduceOnlyCancel"

Breaking (constructors only — spec marks these required, and the contract suite enforces required-ness)

• Perps FCMSubtraderRiskControls.current_im
• Perps GetFCMSubtraderRiskControlsResponse.notional_limits
• Perps NotionalRiskLimitResponse.total_current_usage, current_usage_by_market_ticker

Version bump in this PR: pyproject.toml + kalshi/__init__.py → 16.0.0, CHANGELOG ## 16.0.0 — 2026-09-26, docs/migration.md v15 → v16 note.

Blast radius (manual — GitNexus is not installed on the automation host)

• HistoricalResource / AsyncHistoricalResource .fills/.fills_all/.orders/.orders_all and helper _historical_fills_or_orders_params: new trailing keyword-only kwarg with None default; no internal callers beyond these methods. Low risk.
• MarketsResource / AsyncMarketsResource .list/.list_all and _list_markets_params: new keyword-only kwarg, None default. Low risk.
• ApiKeysResource / AsyncApiKeysResource.generate + _build_generate_api_key_body + GenerateApiKeyRequest / GenerateApiKeyResponse: new optional field/kwarg. Low risk.
• Core FcmResource / AsyncFcmResource: new methods only. Perps FcmResource / AsyncFcmResource: new methods only.
• Perps FCMSubtraderRiskControls, GetFCMSubtraderRiskControlsResponse, NotionalRiskLimitResponse: new required fields — affects perps.fcm.risk_controls() and perps.margin.notional_risk_limit() parsing (server always sends them per spec) and any user code constructing these models. Medium (hence major bump).
• Exports: kalshi/__init__.py, kalshi/models/__init__.py, kalshi/perps/__init__.py, kalshi/perps/models/__init__.py; contract registrations in kalshi/_contract_map.py, tests/_contract_support.py, tests/test_contracts.py.

Not in scope (left for follow-up)

• AsyncAPI communications user_filter subscribe option and core WS user-order last_update_reason field (additive, warning-only)
• Upstream dropped deprecated Market.liquidity_dollars and Klear prev_settlement_prices; SDK keeps its optional fields for now
• Perps asset-class enum narrowed upstream (to Crypto/Equities/Metals); SDK Literal intentionally not narrowed

Gates (local)

• uv run ruff check . — pass
• uv run mypy kalshi/ — pass (160 files)
• uv run pytest tests/ --ignore=tests/integration -q — 4579 passed, 3 skipped
• uv run pytest tests/test_contracts.py -q -W error::UserWarning against fresh upstream specs (nightly-strict mode) — 838 passed (was 18 failed)

Code changes authored with Grok Build (headless), reviewed and gated by the maintainer automation.