Reproducible installs with uv

A lockfile pins every version, exactly

pyproject.toml says PawWalk's backend needs fastapi>=0.115 — a range. That's fine for a human reading it, but terrible for a build: two builds a week apart could resolve to two different fastapi patch versions, and now "it works on my machine" is back. uv — the same tool the course has used since module 13 (uv sync, uv run) — solves this with a lockfile, uv.lock: every dependency (and every dependency of a dependency) pinned to one exact version, generated once by uv lock and committed to the repo.

uv sync --frozen installs exactly what's in uv.lock — it refuses to re-resolve versions, so a build today and a build next month install byte-identical dependencies. That's what "reproducible" means: not "probably the same," but guaranteed the same.