Consolidate test & dev workflows into tox as single source of truth (#160)

* Centralize all Python environments on tox

tox.ini is now the single source of truth for how every Python
environment runs — tests, linting, formatting, dev server, and CI.
No more bare `poetry run` outside of tox.

- Expand tox.ini from 4 to 15 environments (lint, format, typecheck,
  unit, integration, functional, e2e, fast, ollama, ci, coverage,
  coverage-html, pre-commit, dev, all)
- Rewire all Makefile test/lint/format/dev targets to delegate to tox
- Update .githooks/pre-commit to run `tox -e pre-commit`
- Update .pre-commit-config.yaml to use tox instead of poetry run
- Update CI workflow (lint + test jobs) to use `tox -e lint` and
  `tox -e ci` instead of ad-hoc pytest/black/isort invocations
- Update CLAUDE.md to mandate tox usage and document all environments

https://claude.ai/code/session_01MTUpqms1fgezZFrodGA8H5

* refactor: modernize tox.ini for tox 4.x conventions

- Replace `skipsdist = true` (tox 3 alias) with `no_package = true`
- Use `poetry install --no-root --sync` for faster, cleaner dep installs

https://claude.ai/code/session_01MTUpqms1fgezZFrodGA8H5

* fix(ci): drop poetry install from lint/format tox envs

Lint and format only need black, isort, and bandit — not the full
project dependency tree. Override commands_pre to empty and use tox
deps instead. Fixes CI failure where poetry is not on PATH.

https://claude.ai/code/session_01MTUpqms1fgezZFrodGA8H5

* fix(ci): remove poetry run wrapper from all tox commands

Since commands_pre runs poetry install into the tox-managed venv,
all tools (pytest, mypy, black, etc.) are already on the venv PATH.
The poetry run wrapper is redundant and fails in CI where poetry
may not be installed globally.

https://claude.ai/code/session_01MTUpqms1fgezZFrodGA8H5

* fix(ci): remove poetry dependency, align local and CI processes

- Replace `poetry install` with `pip install -e ".[dev]"` in tox
  commands_pre so all envs work without poetry installed
- Remove Poetry cache from GitHub Actions (only pip cache needed)
- Rename pre-commit env to pre-push: runs lint + full CI suite
  (same checks as GitHub Actions, reports generated locally)
- Update CLAUDE.md to reflect new pre-push workflow

The local `tox -e pre-push` now runs the exact same lint + test +
coverage checks as CI, so failures are caught before pushing.

https://claude.ai/code/session_01MTUpqms1fgezZFrodGA8H5

---------

Co-authored-by: Claude <noreply@anthropic.com>

.githooks/pre-commit

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Pre-commit hook: lint + test with a wall-clock limit.
+# Pre-commit hook: format + test via tox.
 # Blocks the commit if formatting, imports, or tests fail.
 # Current baseline: ~18s wall-clock. Limit set to 30s for headroom.
 #
@@ -7,30 +7,28 @@
 
 set -e
 
-echo "Auto-formatting (black + isort)..."
-poetry run black --line-length 100 src/ tests/ --quiet
-poetry run isort --profile black --line-length 100 src/ tests/ --quiet 2>/dev/null
-git add -u
-
 MAX_SECONDS=30
 
-echo "Running tests (${MAX_SECONDS}s limit)..."
+echo "Running pre-commit gate via tox (${MAX_SECONDS}s limit)..."
 
 # macOS lacks GNU timeout; use perl as a portable fallback.
 if command -v timeout &>/dev/null; then
-    timeout "${MAX_SECONDS}" poetry run pytest tests -q --tb=short --timeout=10
+    timeout "${MAX_SECONDS}" tox -e pre-commit
 else
-    perl -e "alarm ${MAX_SECONDS}; exec @ARGV" -- poetry run pytest tests -q --tb=short --timeout=10
+    perl -e "alarm ${MAX_SECONDS}; exec @ARGV" -- tox -e pre-commit
 fi
 exit_code=$?
 
+# Re-stage any files that black/isort reformatted
+git add -u
+
 if [ "$exit_code" -eq 142 ] || [ "$exit_code" -eq 124 ]; then
     echo ""
-    echo "BLOCKED: tests exceeded ${MAX_SECONDS}s wall-clock limit."
+    echo "BLOCKED: pre-commit gate exceeded ${MAX_SECONDS}s wall-clock limit."
     echo "Speed up slow tests before committing."
     exit 1
 elif [ "$exit_code" -ne 0 ]; then
     echo ""
-    echo "BLOCKED: tests failed."
+    echo "BLOCKED: pre-commit gate failed."
     exit 1
 fi