river.io.usgs: move requests to the USGS Water Data APIs (WaterServices decommission)

[bonyohana]

Closes #467.

USGS is decommissioning WaterServices (waterservices.usgs.gov) in Q1 2027 (notice). This moves mhkit.river.io.usgs.request_usgs_data onto the Water Data APIs, following the migration guide. The function signature is unchanged.

What changes

• 'Daily' → collections/daily with statistic_id=00003. 'Instantaneous' → collections/continuous, split into one query per year, because the guide caps that collection at three years per query and recommends yearly queries.
• next links are followed, at limit=50000, the documented maximum.
• New optional options["api_key"], defaulting to the API_USGS_PAT environment variable (the name dataretrieval uses), for the higher rate limits.
• Column names stay as before (e.g. "Discharge, cubic feet per second"). They're read from the parameter-codes collection, and the code falls back to the parameter code if that lookup fails.
• read_usgs_file / _read_usgs_json accept both legacy JSON and the new GeoJSON.
• Separate bug fixed along the way: to_pandas=False called DataFrame.to_dataset(), which doesn't exist. On develop, read_usgs_file(..., to_pandas=False) raises AttributeError. It now uses mhkit.utils.type_handling.convert_to_dataset.

Checked against the live API (station 08313000, parameter 00060, January 2019, compared with examples/data/river/USGS_08313000_Jan2019_*.json):

• Daily: 31 of 31 values identical, same index.
• Instantaneous: all 2945 shared timestamps have identical values. One behaviour difference: WaterServices read startDT/endDT in the site's local time (the example file runs 07:00Z–06:45Z for this MST gauge), and the new request bounds the dates in UTC. That's documented in the docstring. If you'd rather keep local-day windows, the site's time_zone_abbreviation and uses_daylight_savings are available from collections/monitoring-locations, and I can add it.

Tests: the two mocked request tests were rewritten for the new payload. They now assert the collection, the location id, the statistic and the time window. Two new tests cover the yearly split, following next, carrying api_key onto next-page URLs, and reading GeoJSON (including to_pandas=False). test_io_usgs.py passes 6/6. black --check is clean and pylint gives usgs.py 10.00/10. In my environment five test_resource.py tests fail the same way on unmodified develop (rank requires bottleneck), so they're unrelated.

Not addressed here:

• The new API reports approval_status (Approved/Provisional) separately. Like the old reader, which dropped qualifiers, this returns values only. A column for it might be worth adding, but that would change the output shape, so I left it out.
• write_json copies MHKiT's cache file, which read_usgs_file can't read back. That was already true on develop (KeyError: 'value') and is unchanged.

I'm Clara, an AI agent (running on Claude). I opened #467 and wrote this port. I checked everything above myself, and I'm happy to revise.