Migrate the backend from pip to uv

Replace requirements.txt with a uv workspace and lockfile, install the five tavolo packages from packages/* in development and non-editable in the image, and build the Docker image with uv. Move dev tools to a PEP 735 dependency group and refresh the locked dependency versions.

server/Dockerfile

@@ -7,7 +7,7 @@
 #   builder      alpine python -> python venv with the backend + deps
 #   runtime      alpine python + the venv + the compiled frontend
 #
-# apk and pip both use BuildKit cache mounts (type=cache): the package
+# apk and uv both use BuildKit cache mounts (type=cache): the package
 # caches persist in the builder's cache across builds instead of being
 # re-downloaded, and never land in the image layers.
 
@@ -49,29 +49,43 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
 # --- Python builder ----------------------------------------------------------
 FROM alpine:3.24 AS builder
 
+# The official uv image ships a statically linked musl binary, so it works
+# on Alpine. Pin the version so image builds do not change implicitly.
+COPY --from=ghcr.io/astral-sh/uv:0.13.1 /uv /uvx /bin/
+
 RUN --mount=type=cache,target=/var/cache/apk \
-    apk add python3 py3-pip build-base python3-dev
+    apk add python3 build-base python3-dev
+
+# Use Alpine's Python instead of downloading a managed interpreter, install
+# the venv at the same path the runtime stage uses, and copy rather than
+# hardlink from the cache mount (cache and target are different filesystems).
+ENV UV_PYTHON_DOWNLOADS=0 \
+    UV_PROJECT_ENVIRONMENT=/opt/venv \
+    UV_LINK_MODE=copy
 
 WORKDIR /build
 
+# uv needs the workspace root plus the member pyprojects to know which
+# package to sync. Copying only the manifests lets the third-party
+# dependency layer stay cached while application sources change.
+# server/pyproject.toml also carries [tool.aerich], read by the db-migrate
+# compose service with working_dir=/app, next to ./migrations.
+COPY server/uv.lock server/pyproject.toml ./
+COPY server/packages/tavolo-platform/pyproject.toml packages/tavolo-platform/
+COPY server/packages/tavolo-scopone/pyproject.toml packages/tavolo-scopone/
+COPY server/packages/tavolo-scopa/pyproject.toml packages/tavolo-scopa/
+COPY server/packages/tavolo-briscola/pyproject.toml packages/tavolo-briscola/
+COPY server/packages/tavolo-app/pyproject.toml packages/tavolo-app/
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --frozen --no-install-workspace --package tavolo-app --extra otel --no-dev
 
-COPY server/requirements.txt ./
-RUN --mount=type=cache,target=/root/.cache/pip \
-    python3 -m venv /opt/venv \
- && /opt/venv/bin/pip install --upgrade pip \
- && /opt/venv/bin/pip install -r requirements.txt
-
-# The five sibling distributions, installed from the local tree (PEP 420
-# namespace packages sharing the `tavolo` namespace). --no-deps: every
-# third-party dependency — including the tavolo-app `otel` extra — is
-# already pinned in requirements.txt.
+# The five sibling distributions are workspace members (PEP 420 namespace
+# packages sharing the `tavolo` namespace). --no-editable installs them as
+# wheels, so the runtime image does not need their source tree.
 COPY server/packages/ ./packages/
-RUN --mount=type=cache,target=/root/.cache/pip \
-    /opt/venv/bin/pip install --no-deps ./packages/tavolo-platform ./packages/tavolo-scopone ./packages/tavolo-scopa ./packages/tavolo-briscola ./packages/tavolo-app
-# server/pyproject.toml only carries the [tool.aerich] section (the
-# db-migrate compose service runs `aerich upgrade` with working_dir=/app,
-# next to ./migrations).
-COPY server/pyproject.toml ./
+RUN --mount=type=cache,target=/root/.cache/uv \
+    uv sync --locked --no-editable --package tavolo-app --extra otel --no-dev
+
 # aerich migration files are a release artifact: the db-migrate compose
 # service runs `aerich upgrade` from this image before the app starts.
 COPY server/migrations/ ./migrations/