Fix critical bugs, security vulnerability, and code quality issues

[bjinwright]

Critical:

• FloatValidator now rejects integers (isinstance check replaces float() cast)
• IntegerValidator now rejects strings and bools (strict isinstance check)
• ForeignListProperty.get_db_value() no longer crashes — initialize return_type
• ValleyDecoder now requires an allowed_types allowlist to prevent arbitrary class instantiation from untrusted JSON

Major:

• Schema class gets _create_error_dict = True default; validate() no longer AttributeErrors
• BaseProperty.validate() and get_db_value() use is None instead of falsy check (fixes 0/False/[]/'' being treated as missing)
• DateValidator/DateTimeValidator raise on invalid strings immediately instead of silent pass
• ForeignProperty/ForeignListProperty use to_dict() instead of ._data directly
• FloatProperty now wires up min_value/max_value kwargs like IntegerProperty

Minor/Nit:

• Remove import time; use datetime.date.fromisoformat()
• BooleanProperty.get_default_value() returns None when unset
• Replace type(None) antipattern with is not None
• Add type hints and docstrings to DateValidator/DateTimeValidator
• Use f-strings consistently in date validators
• Fix unicode -> str in example schemas
• ChoiceValidator handles non-dict choices safely
• Guard inspect.getmodule() None return in ValleyEncoder
• Remove collections.OrderedDict from declarative.prepare (redundant in 3.7+)
• Fix octal escape typo in EmailValidator regex (\001-011 -> \001-\011)
• ForeignListProperty.get_validators() uses append() instead of insert(len())
• Stale StringProperty docstring "CharProperty" corrected
• Add PEP 8 blank line between DateTimeValidator and BooleanValidator
• Clarify requirements.txt as Poetry-managed

https://claude.ai/code/session_01JGryFUpmEmKYAVhqSrkV8R