dev tooling: uv + Makefile + tighter CI, secret-redacted repr

[vladmarascu]

Summary

• Switch dev workflow to uv (lockfile committed for reproducible installs)
• Add Makefile with 6 targets (sync, test, lint, format, check, clean)
• Tighten CI: now runs ruff format --check and gates coverage at 80%
• Redact api_key in LagoConfig.__repr__ / LagoClient.__repr__ so logs/Sentry/print() can't leak it

Changes

Tooling

• uv.lock, .python-version (3.11) committed; CI uses astral-sh/setup-uv@v4 with cache
• pyproject.toml: pytest-cov>=5 added to dev extras
• Makefile wraps the common commands; make check is CI parity
• CONTRIBUTING.md rewritten around the uv + make flow

CI (.github/workflows/ci.yml)

• ruff format --check is now a gate (was missing — CONTRIBUTING.md told contributors to run it but CI didn't enforce)
• pytest --cov-fail-under=80 (baseline measured at 81.5%; bump after backfilling repr tests)
• Uploads coverage.xml artifact on the 3.12/ubuntu cell

Code

• LagoConfig.__repr__ masks api_key as ***xxxx (last 4 chars only); field(repr=False) on the attribute as defence-in-depth
• LagoClient.__repr__ masks the same way
• Added smoke test with sample question to prove usecase.

One-time format pass

• 36 files reformatted by ruff format. All cosmetic — no logic changes. Necessary so the new ruff format --check gate passes on day 1.

Test plan

• make lint passes locally (ruff check / format / mypy)
• make test — 237 passed, coverage 81.53% (above the 80% floor)
• CI matrix (ubuntu + macOS × py3.10/3.11/3.12) — see Actions tab

Follow-ups (not in this PR)

• Coverage on lago_client.py is 46% — the unit suite mocks EventQueue.sender directly, so LagoClient.send_batch is exercised only by integration tests. New __repr__ adds to the gap; small dedicated test would close it and let us raise the coverage floor.