deps: install from uv.lock (hash-pinned) in the image and CI, never floating

The API image did 'pip install -e .' and CI 'pip install -e ".[dev]"':
every rebuild could ship newer fastapi/starlette/pydantic than CI tested
(Windy Cloud hit exactly this 09-23). uv.lock is cut to EXACTLY what prod
runs now (42 runtime pkgs, 0 differences; botocore/pyjwt held back to
prod's versions). Image: uv 0.12.5 exports, pip --require-hashes installs,
same layout. CI: uv sync --locked (also fails on a stale lock).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.gitea/workflows/check.yml

@@ -51,9 +51,10 @@ jobs:
       - name: install
         run: |
           python3 --version
-          python3 -m venv .venv
-          .venv/bin/pip install -q --upgrade pip
-          .venv/bin/pip install -e ".[dev]"
+          # From uv.lock, never floating: CI tests exactly what the image ships.
+          # --locked also FAILS if pyproject.toml changed without re-locking.
+          python3 -m pip install -q uv==0.12.5
+          uv sync --locked --extra dev
 
       - name: lint
         run: .venv/bin/ruff check api scripts