T08: Python lock files, CI web unit tests, dependency audit

- Generate requirements-lock.txt and requirements-dev-lock.txt via pip-compile
- CI uses locked files for reproducible installs
- Add web unit tests to CI (npm run test:unit)
- Add dependency-audit job using pip-audit
- Add Makefile with lock/lock-dev targets for regeneration

apps/api/requirements-dev-lock.txt

@@ -0,0 +1,123 @@
+#
+# This file is autogenerated by pip-compile with Python 3.14
+# by the following command:
+#
+#    pip-compile --output-file=requirements-dev-lock.txt requirements-dev.txt
+#
+alembic==1.16.5
+    # via -r requirements.txt
+annotated-types==0.8.0
+    # via pydantic
+anyio==4.15.1
+    # via
+    #   httpx
+    #   starlette
+    #   watchfiles
+beautifulsoup4==4.15.0
+    # via -r requirements.txt
+boto3==1.40.35
+    # via -r requirements.txt
+botocore==1.40.76
+    # via
+    #   boto3
+    #   s3transfer
+certifi==2026.7.22
+    # via
+    #   httpcore
+    #   httpx
+click==8.5.0
+    # via uvicorn
+fastapi==0.116.1
+    # via -r requirements.txt
+h11==0.16.0
+    # via
+    #   httpcore
+    #   uvicorn
+httpcore==1.0.9
+    # via httpx
+httptools==0.8.0
+    # via uvicorn
+httpx==0.28.1
+    # via -r requirements.txt
+idna==3.19
+    # via
+    #   anyio
+    #   httpx
+iniconfig==2.3.0
+    # via pytest
+jmespath==1.1.0
+    # via
+    #   boto3
+    #   botocore
+mako==1.4.1
+    # via alembic
+markupsafe==3.0.3
+    # via mako
+packaging==26.3
+    # via pytest
+pillow==11.3.0
+    # via -r requirements.txt
+pluggy==1.6.0
+    # via pytest
+psycopg[binary]==3.2.10
+    # via -r requirements.txt
+psycopg-binary==3.2.10
+    # via psycopg
+pydantic==2.13.5
+    # via
+    #   fastapi
+    #   pydantic-settings
+pydantic-core==2.46.5
+    # via pydantic
+pydantic-settings==2.10.1
+    # via -r requirements.txt
+pygments==2.21.0
+    # via pytest
+pytest==8.4.2
+    # via -r requirements-dev.txt
+python-dateutil==2.9.0.post0
+    # via botocore
+python-dotenv==1.2.3
+    # via
+    #   pydantic-settings
+    #   uvicorn
+python-multipart==0.0.20
+    # via -r requirements.txt
+pyyaml==6.0.3
+    # via uvicorn
+s3transfer==0.14.0
+    # via boto3
+six==1.17.0
+    # via python-dateutil
+soupsieve==2.9.2
+    # via beautifulsoup4
+sqlalchemy==2.0.43
+    # via
+    #   -r requirements.txt
+    #   alembic
+starlette==0.47.3
+    # via fastapi
+typing-extensions==4.16.0
+    # via
+    #   alembic
+    #   anyio
+    #   beautifulsoup4
+    #   fastapi
+    #   pydantic
+    #   pydantic-core
+    #   sqlalchemy
+    #   typing-inspection
+typing-inspection==0.4.4
+    # via
+    #   pydantic
+    #   pydantic-settings
+urllib3==2.7.0
+    # via botocore
+uvicorn[standard]==0.35.0
+    # via -r requirements.txt
+uvloop==0.22.1
+    # via uvicorn
+watchfiles==1.2.0
+    # via uvicorn
+websockets==17.1
+    # via uvicorn