Add the fluksio CLI: serve, enroll, worker

`pip install fluksio && fluksio serve` on a machine with no Docker, no
database and no configuration — which is the case this is for: a node on
a cluster where ports cannot be opened. It makes its data directory, its
key and an admin account, prints the password once, and serves. Pairing
is `fluksio enroll <code> --portal …`, doing what the Settings screen
does through the same function, before the engine starts and without one
running — a machine nobody can route to has no browser pointed at it
either. The portal serves the dashboard, so nothing is served here.

Two things had to give way. `fastapi[standard]` pulls a cloud CLI that
wants sentry-sdk 2.x while we pinned below it — no pip resolution
existed, so the pin is lifted, which the comment beside it had been
waiting for and which also lets the Python cap go. And `uv` is now a
dependency rather than something to find on PATH: the Modules screen is
how a data scientist installs torch, and it was quietly falling back to
the engine's own interpreter.

The CLI imports nothing from the engine before it has set DATA_DIR — the
settings are built on the first import of core.config, and reaching it
early put the database in the working directory. There is a test for
that now, because the failure is silent.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

backend/pyproject.toml

@@ -2,9 +2,7 @@
 name = "fluksio"
 version = "0.1.0"
 description = "Node-based automation engine: flows, dashboards, batch runs"
-# Capped below 3.14: the MCP SDK wants a newer starlette there than the
-# pinned sentry-sdk allows. Lift it when sentry-sdk moves to 2.x.
-requires-python = ">=3.10,<3.14"
+requires-python = ">=3.10"
 dependencies = [
     "fastapi[standard]<1.0.0,>=0.114.2",
     "python-multipart<1.0.0,>=0.0.7",
@@ -17,7 +15,7 @@ dependencies = [
     "httpx<1.0.0,>=0.25.1",
     "sqlmodel<1.0.0,>=0.0.21",
     "pydantic-settings<3.0.0,>=2.2.1",
-    "sentry-sdk[fastapi]<2.0.0,>=1.40.6",
+    "sentry-sdk[fastapi]>=2.20.0",
     "pyjwt<3.0.0,>=2.8.0",
     "pwdlib[argon2,bcrypt]>=0.3.0",
     "numpy>=2.2.6",
@@ -28,8 +26,15 @@ dependencies = [
     "croniter>=1.3.0",
     "mcp>=1.29,<2",
     "fluksio-worker>=0.1,<0.2",
+    # The Modules screen installs node code's packages with it, into a venv of
+    # the user's own. Present in the image; a pip install would otherwise have
+    # to find one on PATH, and quietly fall back to the engine's interpreter.
+    "uv>=0.5",
 ]
 
+[project.scripts]
+fluksio = "fluksio.cli:main"
+
 [tool.uv.sources]
 fluksio-worker = { workspace = true }
 
@@ -93,6 +98,11 @@ ignore = [
 ]
 
 [tool.ruff.lint.per-file-ignores]
+# The node API's stubs carry the real signatures and raise; unused arguments
+# are what a stub is.
+"fluksio/__init__.py" = ["ARG001"]
+# It talks to whoever ran it; that is what a command line is.
+"fluksio/cli.py" = ["T201"]
 # Node functions take `params` whether or not they use it — that is the
 # contract the engine calls them with.
 "fluksio/flow/nodes.py" = ["ARG001", "ARG002"]