feat: consistent return shape via last_response metadata (#140)

[martinkersner]

Closes #140

Summary

send_request returned a bare payload normally, but a {"data": ..., "limit_usage": ..., "header": ...} wrapper when show_limit_usage/show_header was set — so the return type branched on a constructor flag.

Worse, while tracing it I found the wrapper keyed metadata under "data", which collided with the backend's own {"data": ...} envelope. Resource methods do res["data"] expecting the backend list, so the wrapped path handed them the whole backend dict instead — silently corrupting every DataFrame-returning method (cex.candle, cex.ticker, funding_rate, premium, ...). Those flags were effectively broken.

Change (side-channel metadata — the approved approach)

• send_request always returns the payload (DataFrame / backend dict, exactly as a plain client already did).
• Metadata is recorded on api.last_response as a small ResponseMeta(status_code, headers, limit_usage, data), surfaced as a last_response property on Resource → client.<resource>.last_response. Since the tree shares one transport (refactor: share one Session across the client tree via composition (#2, #3) #137), it reflects the last call through it.
• show_limit_usage/show_header are deprecated (option-2 lifecycle): still accepted and stored, no longer change the return shape, and now emit a DeprecationWarning when passed truthy so callers get a runtime nudge before a future major removes them.

df = client.cex.candle(...)                    # unchanged
client.cex.candle.last_response.limit_usage    # {"x-ratelimit-remaining": "99", ...}

Compatibility

• Non-flag users: zero change — the common path already returned the bare payload, no warning.
• Users who set the flags: same return as a plain client now + a DeprecationWarning; read metadata from last_response. The old wrapped path was buggy/inconsistent (see above), so this is a net fix.

Tests

• New tests/test_last_response.py (6 tests): last_response None before any call; populated after; flags don't wrap the return; shared across the client tree; deprecation warning emitted for each flag; no warning when flags absent/False.
• Updated tests/test_api.py flag tests to assert the DeprecationWarning.
• pytest -m "not integration": 145 passed, 11 skipped.
• black + flake8 clean.

Known failures

None.