chore: improve open-source security readiness - #1

Summary

• Remove tracked runtime/test artifacts and bundled Microsoft font binaries before open-source publication.
• Consolidate dependency locking around the root workspace uv.lock and remove stale nested locks that were carrying vulnerable pins.
• Upgrade vulnerable runtime/dev dependencies flagged by Trivy, including Authlib, FastAPI/Starlette, FastAPI Users/PyJWT, aiohttp, Pillow, cryptography, pypdf, lxml, requests, python-dotenv, and pytest tooling.
• Harden API/worker Dockerfiles with --no-install-recommends, no RUN cd ..., and non-root runtime execution.
• Keep contract tests explicit about billing route availability after the dependency upgrades.

Validation

• uv lock --check -p /home/suguan/.local/bin/python3.11
• uv run -p /home/suguan/.local/bin/python3.11 --all-packages --group lint ruff check apps packages
• uv run -p /home/suguan/.local/bin/python3.11 --all-packages --group typecheck pyright --project pyproject.toml apps/api/app apps/api/main.py apps/worker/app apps/worker/worker.py packages/shared-python/shared
• uv run -p /home/suguan/.local/bin/python3.11 pytest apps/api/tests apps/worker/tests/contract -q (90 passed)

Security Scan Follow-up

• gitleaks dir . --redact: 0 findings
• trivy fs --scanners vuln,secret,misconfig: 0 vulnerabilities, 0 secrets, 0 misconfigs
• checkov -d .: report generated
• bandit -r apps packages: 13 medium / 750 low findings remain for separate code-level review