Add the fluksio CLI: serve, enroll, worker

`pip install fluksio && fluksio serve` on a machine with no Docker, no
database and no configuration — which is the case this is for: a node on
a cluster where ports cannot be opened. It makes its data directory, its
key and an admin account, prints the password once, and serves. Pairing
is `fluksio enroll <code> --portal …`, doing what the Settings screen
does through the same function, before the engine starts and without one
running — a machine nobody can route to has no browser pointed at it
either. The portal serves the dashboard, so nothing is served here.

Two things had to give way. `fastapi[standard]` pulls a cloud CLI that
wants sentry-sdk 2.x while we pinned below it — no pip resolution
existed, so the pin is lifted, which the comment beside it had been
waiting for and which also lets the Python cap go. And `uv` is now a
dependency rather than something to find on PATH: the Modules screen is
how a data scientist installs torch, and it was quietly falling back to
the engine's own interpreter.

The CLI imports nothing from the engine before it has set DATA_DIR — the
settings are built on the first import of core.config, and reaching it
early put the database in the working directory. There is a test for
that now, because the failure is silent.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -10,13 +10,35 @@ repo holds the FastAPI backend, the flow engine, and the dashboard SPA. It is se
 ## Layout
 
 ```text
-backend/        FastAPI + SQLModel + Alembic + SQLite
+backend/        FastAPI + SQLModel + Alembic + SQLite — the `fluksio` distribution
   fluksio/flow/ the flow engine (nodes, pipeline, state backends, controller)
+  fluksio/cli.py  `fluksio serve` / `enroll` / `worker`
+worker/         the `fluksio-worker` distribution: the agent and the node runner
 frontend/       React 19 + TanStack Router + Tailwind 4 + shadcn/ui
 docker/         compose.yml → compose.dev.yml → compose.local.yml (+ compose.traefik.yml)
 scripts/        generate-client.sh, test.sh
 ```
 
+## Install without Docker
+
+```sh
+pip install fluksio
+fluksio serve                       # ~/.fluksio, SQLite, prints an admin password once
+fluksio enroll <code> --portal https://hub.fluksio.com   # watch it from the portal
+```
+
+Nothing else has to be running. `--data-dir` puts the installation somewhere else —
+worth it on a cluster, where `$HOME` is often a network filesystem SQLite cannot use.
+The dashboard is served by the portal, so a machine with no inbound route is reached
+without opening a port: it dials out.
+
+A machine that should only *run nodes* for an engine elsewhere installs less:
+
+```sh
+pip install fluksio-worker
+fluksio-worker --url wss://api.example.com/api/v1/workers/attach --token "$TOKEN" --labels gpu
+```
+
 ## Getting started
 
 Normally driven from the workspace root (`make init` once, then `make dev`). Standalone: