Pin backend dependencies using pip-compile

[ambv]

Any merged PR triggers deploy events for both frontend and backend, and currently the backend requirements.txt is outdated with insufficient pinning, leading to a failed deploy.

This PR fixes that by employing pip-compile to pin production deps and allow updating the pins painlessly.

There's some semi-related documentation churn here, too, standardizing development on "docker compose". There wasn't a great place to put those changes in separately, so let's just be done with it now.

[Copilot]

Pull request overview

Pins backend Python dependencies using pip-compile to prevent deploy breakages from drifting/unpinned packages, and adds documentation + CI guardrails to keep the lockfile updated.

Changes:

• Introduce backend/requirements.in and regenerate backend/requirements.txt as a fully pinned, hashed lockfile.
• Update docs with a repeatable pip-compile workflow for updating backend dependency pins.
• Replace the dummy CI workflow with a PR check that enforces updating requirements.txt when requirements.in changes.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
docker-README.md	Documents how to regenerate backend dependency pins with pip-tools.
backend/requirements.txt	Replaces the old loosely-pinned requirements with a pip-compiled, hashed lockfile.
backend/requirements.in	Adds the source-of-truth direct dependency list for pip-compile.
backend/Dockerfile.dev	Updates the dev image base to Python 3.13 bookworm to match the lockfile generation context.
README.md	Updates prerequisites and documents the backend lockfile update process.
.github/workflows/ci.yml	Adds a PR-time check to ensure lockfile changes accompany input dependency changes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.