fix: pin dependencies to exact versions using pip-tools

[shiwani42]

Closes #868

Summary

• Introduces pip-tools for reproducible dependency management
• requirements.in is the human-maintained list of direct dependencies, deduplicated and normalised from the previous requirements.txt (removed 8 duplicates, normalised package names e.g. scikit_learn to scikit-learn, pygithub to PyGithub)
• requirements.txt is now the pip-compiled lockfile with all transitive dependencies pinned to exact versions, generated with Python 3.12.3 to match CI
• Adds make update-deps target for regenerating the lockfile
• Documents the workflow in docs/developmentSetup.md so contributors know to edit requirements.in and run make update-deps rather than editing requirements.txt directly

No changes to CI or install workflow. pip install -r requirements.txt continues to work as before.

Test plan

• Fresh venv install from old unpinned requirements.txt vs new pinned requirements.txt: identical test results (113 tests, same 3 pre-existing failures, same 5 pre-existing errors)
• black --check passes on both
• mypy produces same 752 pre-existing errors on both
• flask routes loads all 41 routes on both
• Lockfile compiled with Python 3.12.3 matching CI