Modernize CI and publish version 2.1.1 on merge

[olucurious]

What changed

• modernize checkout and Python setup actions
• split linting and tests, with tests covering Python 3.9 through 3.13
• build and publish to PyPI only after lint and tests pass on a push to the default master branch
• retain the existing PYPI_USERNAME and PYPI_PASSWORD secrets for compatibility
• skip an already-published version instead of failing the workflow
• remove the separate release-triggered publishing workflow
• bump the package version from 2.1.0 to 2.1.1

Why

Publishing should follow a successful merge to the repository's current default branch rather than requiring a separate GitHub release. Keeping publishing behind the same CI dependencies prevents an unverified package upload.

Validation

• black --target-version py310 --check .
• flake8 fatal-error checks
• pytest (11 passed)
• built wheel and source distribution for 2.1.1
• twine check dist/*
• parsed the workflow YAML