Python template: install dev tools with uv sync and keep the venv on PATH

[turegjorup]

The Python template's dev image gets its test and lint tools, and they are reachable when the workflows run them in a service with the template's ./:/app bind mount.

Changes

• templates/python/pyproject.toml: dev tools in [dependency-groups] dev instead of [project.optional-dependencies] dev
• templates/python/Dockerfile: UV_PROJECT_ENVIRONMENT=/opt/venv and /opt/venv/bin on PATH; /opt/venv created and owned by app

Why

• uv sync installs the dev dependency group by default and skips it with --no-dev, but installs optional extras only with --extra dev. With an extra, the dev target had no pytest, ruff or basedpyright.
• uv sync creates the venv in /app/.venv, which the ./:/app bind mount in docker-compose.yml hides, and nothing put .venv/bin on PATH. The workflows call pytest --cov, ruff and basedpyright directly, so both failed with "executable file not found in $PATH".
• /opt/venv is the setup AarhusAI/automated-tests already uses for the same reason. search-agent, where the Dockerfile comes from, avoids the problem by mounting only ./src and ./tests and calling tools through uv run.

Tested in AarhusAI/aarhusai-audit, which applies the template with these two changes: ruff check, ruff format --check, basedpyright, uv lock --check and pytest --cov pass in the labelled service. The template itself does not build as-is (placeholders, no src/).