python: declaration reader and rule A (model decorator) #1386

Created with Claude Code from the spec in #1341.

Parent

Sub-issue of #1341. Ticket 5 of 14.

What to build

A developer writes

@stackencrypt.model("users")   # decorator name is an assumption; see PR #1284
class User:
    email: Annotated[str, stackencrypt.TextEq]
    age: Annotated[int, stackencrypt.Passthrough]

on a dataclass, an attrs class, a Pydantic model, a NamedTuple or a SQLAlchemy declarative class, and the class statement either completes or raises DeclarationError at that line, with no credentials and no network. This ticket covers the reader and rule A only: every annotated field must carry exactly one marker.

Covered here: DECLARATION_NO_MARKER, DECLARATION_TWO_MARKERS, DECLARATION_NOT_OUTERMOST (the marker must be in the outermost Annotated, with the structural wrapper rule for Mapped[Annotated[...]]), Ignore fields leaving the plan. The plan the reader produces is the input to the next ticket.

Acceptance criteria

• Each of the five class kinds declares successfully with one TextEq field, one Passthrough field and one Ignore field.
• The three codes above raise DeclarationError with the field name and the code in the message.
• Mapped[Annotated[str, TextEq]] is accepted; Annotated[Mapped[str], TextEq] is refused with NOT_OUTERMOST.
• A relationship marked Ignore does not appear in the plan.
• Tests run on 3.9 and 3.14 in CI, with and without from __future__ import annotations.