tests: make test server robust when portpicker is unavailable

[shuofengzhang]

What changed

• Added a small _pick_unused_port() helper in tests/server.py.
  • Uses portpicker.pick_unused_port() when portpicker is installed.
  • Falls back to a stdlib socket-based ephemeral port selection when portpicker is not installed.
• Replaced direct portpicker.pick_unused_port() calls in test server setup/context managers with _pick_unused_port().
• Wrapped import portpicker in a safe optional import (ModuleNotFoundError fallback) for test-only robustness.

Why

• In environments that run tests without the uv dev dependency group (for example plain pip + pytest), test collection fails early with:
  • ModuleNotFoundError: No module named 'portpicker'
• This makes the repository look broken even though the SDK code is fine.

Insight / Why this matters

• Root cause: tests/server.py had an unconditional portpicker import, but portpicker is only guaranteed through a dev dependency group workflow.
• Why easy to miss: maintainers and CI often use uv sync --dev, so the hidden hard dependency does not surface.
• Tradeoff: socket-based fallback can theoretically race between port selection and bind (same general caveat as pre-picking ports), but this behavior is already acceptable for local test harness use.
• Impact: test suite becomes resilient across more contributor/tooling setups without changing production SDK behavior.

Practical gain / Why this matters

• Contributors and automation that use lightweight pip-based test setup can run the suite successfully instead of failing during collection.
• Reduces false-negative workflow failures and lowers friction for external contributors.

Testing

• Baseline reproduction before change:
  • scripts/clone_and_test.sh xai-org/xai-sdk-python
  • Result: test collection failed with ModuleNotFoundError: No module named 'portpicker'.
• Validation after change:
  • source .venv/bin/activate && pytest -q
  • Result: 509 passed, 20 warnings.

Risk analysis

• Scope is test-only (tests/server.py), no runtime SDK API behavior changes.
• Change is rollback-safe: reverting this single file fully restores previous behavior.