Track uv.lock for reproducible dev environments

Pins the dev tool versions (pytest, ruff, mypy) and transitive deps so
`uv sync` yields the same environment across machines. The lockfile
doesn't leak into the published wheel/sdist (uv strips it from
distribution metadata), so PyPI consumers still resolve via the
pyproject.toml version specifiers. Matches what python-dqlite-dbapi
already does.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: antoineleclair