fix: restore direct CAA login preparation

[subzeroid]

Summary

• Automatically run the CAA preflight when the public direct send helper has no server-issued AAC, while preserving prepared and explicit opt-out flows.
• Forward domain and flow overrides through process/OAuth preparation, and roll partial login state back when preparation raises so retries cannot skip an incomplete preflight.
• Document the compatibility behavior and add the CAA regression class to the Python 3.10-3.14 compatibility matrix.

Verification

• pytest -q -p no:cacheprovider tests/regression — 762 passed, 3 skipped, 29 subtests passed
• ruff check .
• ruff format --check .
• bandit -c pyproject.toml -r instagrapi
• mkdocs build --strict
• pre-commit run --all-files
• uv build
• Live credential verification — the direct helper automatically completed the CAA preflight and returned a usable session; domain, waterfall, AAC, and attestation continuity were verified across the flow, with exactly one final credential request. The returned session was not applied or saved.

Related: subzeroid/aiograpi#428