[github-actions]Update version.py to Release 2.2.2

Replace the pre-2.0 pipeline illustration in the README with the new
landing-page asset from datajoint-docs. The previous PNG bundled a
diagram and a code snippet using legacy type names (longblob, double)
and was rendered from a now-stale .drawio source.

- Add images/pipeline.svg as the editable source of truth (text in
  the repo — no separate file to lose).
- Re-render images/pipeline.png from the SVG so the existing README
  image link continues to work without changes (GitHub raw SVGs serve
  as text/plain and don't render inline; PNG remains the safer choice
  for README display).
- Remove images/pipeline.drawio — superseded by the SVG, no longer
  the source of truth.

The new illustration uses calcium-imaging vocabulary that matches the
docs (Subject/Session/Scan/AverageFrame/Segmentation/Activity), follows
DataJoint's notation (rectangles for Manual/Lookup, ovals for
Imported/Computed), and shows 2.0 type syntax (int32, <blob@>).

Replace the bioRxiv 2021 reference under the Example Pipeline with the
2.0 manuscript (arXiv:2602.16585) so the inline citation matches the
DOI badge in the project header.

Add RRID:SCR_014543 alongside the citation so DataJoint can be
identified unambiguously when cited in scientific publications.

docs: cite DataJoint 2.0 manuscript and add RRID

Address review feedback on the new landing-page illustration:

- Add an opaque white background rect covering the full viewBox so
  the entire illustration (annotations included) reads correctly
  against any page theme. Previously the code panel had its own white
  rect but the surrounding annotations sat on transparent — black
  text on a black page background made them invisible in GitHub's
  dark-mode README rendering.
- Bump the annotation font size from 17 to 19 to keep effective
  rendered text in the 9-11pt range when displayed at typical README
  column widths.

Re-render images/pipeline.png from the updated SVG.

docs: refresh README pipeline illustration

The absolute raw.githubusercontent.com URL is served via GitHub's camo
image proxy, which caches aggressively — so even after #1448 refreshed
images/pipeline.png, the rendered README kept showing the old image.

Switching to a relative path lets GitHub serve the image directly from
the current commit, so the new illustration appears immediately and
future updates to the file render without cache hiccups.

…-path

docs: use relative path for README pipeline image

Two changes:

1. settings.py — Config._load_secrets()
   Was hardcoded to only auto-load stores.<name>.access_key and
   stores.<name>.secret_key from the secrets directory. That whitelist
   made sense when only the built-in s3 / gcs / azure stores existed,
   but it's wrong for plugin-registered adapters that define their own
   secret fields.

   Concrete example: a plugin that wraps Databricks Unity Catalog
   Volumes authenticates via a Bearer token. Its store spec wants a
   `token` field. Today the file .secrets/stores.uc.token is silently
   ignored, forcing users to either rename to a misleading
   "access_key" or to set the value programmatically at notebook
   startup (defeating the auto-load story).

   This change drops the whitelist. Any stores.<name>.<attr> file under
   the secrets directory is loaded into
   dj.config["stores"][<name>][<attr>]. The existing "don't override
   pre-configured values" precedence is preserved — config file and
   env vars still win.

   New test: TestStoreSecrets.test_load_store_arbitrary_attr confirms
   that `token` and `api_key` fields load via the same path as
   access_key/secret_key.

2. storage_adapter.py — _discover_adapters()
   Removed the try/except wrapping importlib.metadata.entry_points().
   The fallback path was for Python < 3.10 (where entry_points()
   returned a SelectableGroups dict instead of accepting the
   group= kwarg), but DataJoint's minimum supported Python is 3.10
   (per requires-python in pyproject.toml). The dead branch was also
   producing a mypy type error (SelectableGroups.get signature).

… 2.3

Adds env-var configuration for object stores so the DataJoint platform — and
any env-var-only deployment — can configure plugin-registered storage adapters
(Databricks Unity Catalog Volumes, custom HTTP stores, lab archive systems)
without files on disk.

- DJ_STORES (JSON-encoded) carries the entire `stores` dict in the same shape
  used in `datajoint.json`. Replaces the file's `stores` block when set.
- DJ_IGNORE_CONFIG_FILE (default false) skips `datajoint.json`, the project
  `.secrets/`, and `/run/secrets/datajoint/` entirely. Hard guarantee that no
  file on disk leaks into config.

Implementation notes:

- New `Config.ignore_config_file` field (validation_alias DJ_IGNORE_CONFIG_FILE)
  auto-bound by pydantic-settings.
- The `stores` field receives a `validation_alias` placeholder so
  pydantic-settings does NOT auto-bind DJ_STORES at Config() construction.
  Otherwise its built-in JSON parser intercepts before precedence logic runs
  and reports SettingsError instead of a clean ValueError.
- New `Config._apply_stores_env()` parses DJ_STORES JSON, replaces self.stores
  wholesale, raises ValueError on bad JSON or non-object payloads.
- `_create_config()` restructured to: skip file + secrets when
  ignore_config_file is set; apply DJ_STORES between file load and secrets
  fill so env wins over file and secrets only fill gaps.

Functional precedence (high to low): programmatic > DJ_STORES > config file >
`.secrets/stores.<name>.<attr>` (fills missing attrs only).

Tests: new TestStoreEnv class with 8 tests; existing TestStoreSecrets and
test_storage_adapter tests still pass.

Companion docs: datajoint/datajoint-docs#172

Three issues caused docstring code to render as plain text on
https://docs.datajoint.com/api/datajoint/codecs/ (mkdocstrings is
configured for docstring_style: numpy + Markdown-flavored bodies):

- Codec class docstring used reST '::' literal blocks for the two
  table-definition examples. Replaced with Markdown fenced code blocks.
- decode_attribute used Google-style 'Args:'/'Returns:' sections in a
  NumPy-configured doc generator. Converted to NumPy 'Parameters'/
  'Returns' with dashed underlines so it renders as a parameter table
  consistent with the rest of the module.
- Module-level 'Example:' block now uses a Markdown fenced code block
  rather than relying on 4-space indentation.

No behavior change - docstrings only.

The module's docstring and runtime DeprecationWarning still pointed
at the older "removed in 2.3 / while on 2.0" timeline. The module is
still present at 2.2.x and 2.3 is shipping with it intact, so push
the targets forward:

- Removal target: 2.4 or 2.5 (was: 2.3)
- Safe migration window: 2.3 or earlier (was: 2.0)

Matches the warning text in the migration how-to in datajoint-docs.

…matting

docs: fix code formatting on rendered codecs API page

docs: extend datajoint.migrate timeline to 2.4 or 2.5

feat(config): DJ_STORES env var + DJ_IGNORE_CONFIG_FILE flag + arbitrary .secrets/ attrs — 2.3

Neither directory plays any role in the published package, CI tests, or
release path. The .devcontainer/Dockerfile had drifted from current
tooling (still installing nose/nose-cov), and pixi already provides a
reproducible dev env. Also drops the now-dead check-json exclude in
.pre-commit-config.yaml.

chore: remove .vscode and .devcontainer