Preinstall Python dependencies in system API image

[miki3421]

What changed

• Installs runtime dependencies with uv sync --frozen --no-dev during the image build.
• Copies dependency metadata before application source to preserve the Docker dependency layer cache.
• Starts the service directly with the virtual-environment Python interpreter.
• Updates run.sh to avoid uv run and any runtime dependency synchronization.

Root cause

The image previously used uv pip install against pyproject.toml during the build, then uv run at container startup. Since the build installation was not synchronized from uv.lock, uv run downloaded packages and replaced part of the environment at runtime. Pods without direct PyPI or proxy access could enter CrashLoopBackOff.

Impact

The system API image is self-contained after docker build. A stale lock now fails the build instead of causing runtime downloads, and source-only changes can reuse the dependency layer.

Validation

• Built the arm64 image inside the Lima VM with uv sync --frozen; 53 runtime packages were installed during build.
• Verified core imports with docker --network none.
• Loaded the image into Kind and completed the nuvolaris-system-api StatefulSet rollout.
• Confirmed PID 1 uses /home/openserverless/.venv/bin/python.
• Confirmed startup logs contain no package downloads or environment synchronization.
• Ran testing/tests/11-sso-mock.sh kind successfully, including password login, user provisioning, hello action and cleanup.

The unrelated local uv.lock modification is intentionally excluded from this PR.