Tooling updates with supply chain delays

[bjester]

Overview

Migrate from pip/tox/setup.py to uv, and replace flake8/black with ruff, following the same approach as learningequality/kolibri#14457.

Complexity: Low
Target branch: release-v0.9.x

Context

Kolibri has migrated to uv for Python version management, virtual environments, dependency resolution, and CI. The same migration should be applied across the ecosystem for consistency.

The Change

• Replace flake8/black/reorder-python-imports with ruff
• Configure exclude-newer = "7 days" in [tool.uv] for supply chain safety
• Add uv-lock pre-commit hook (from astral-sh/uv-pre-commit) to keep uv.lock in sync
• Add a cooldown period to the dependabot.yml with a value of 7 days
• Update developer documentation

Acceptance Criteria

• Linting and formatting handled by ruff
• Pre-commit hooks use ruff
• exclude-newer cooldown configured in pyproject.toml
• uv-lock pre-commit hook added to .pre-commit-config.yaml
• cooldown of 7 days configured in dependabot.yml
• All existing tests pass
• Developer documentation updated

AI usage

This issue was copied from another issue written by AI