Harden MARTA API requests and credential handling

[cacheflow]

Improves the security and resilience of the existing MARTA client while preserving the legacy API domain, paths, and public interface.

Changes

• Upgrade legacy API requests from HTTP to HTTPS.
• Pass API keys as request parameters without exposing them in error messages.
• Replace global persistent caching with a private in-memory cache.
• Add connection and read timeouts.
• Reject unexpected content types, malformed response shapes, and responses larger than 5 MiB.
• Raise errors for unsuccessful HTTP responses.
• Bound dependency versions.
• Fix custom exception initialization.
• Expand coverage for existing filtering behavior and new request hardening.
• Add pytest configuration so the package imports correctly when tests run from either the repository or its parent directory.