chore(deps): remove unused Python dependencies and relock

[usehoplite]

Summary

Dependency audit of both dependency manifests. Removal is restricted to dependencies proven unused by the code, verified via go mod tidy (Go) and a full import scan plus Poetry resolution (Python).

Python (pyproject.toml + poetry.lock)

• Removed 6 declared dependencies that nothing imports: python-magic, attrs, pydantic, structlog, requests, opentelemetry-instrumentation. Their transitives dropped from the lock: annotated-types, pydantic-core, typing-inspection, wrapt.
• Added 2 packages the worker actually imports but the previous lock never contained: psycopg-pool (worker/consumer/db.py), python-dotenv (worker/__main__.py). They existed only in the legacy [tool.poetry.dependencies] table, which Poetry 2.4.1 (the lock's own generator) ignores — so a fresh poetry install could not run the worker at all.
• Deleted the dead [tool.poetry.dependencies] table — duplicate, ignored by the generator, and actively misleading (declared packages that were never locked).
• Lockfile regenerated with Poetry 2.4.1: 58 → 51 packages. requests/urllib3/certifi remain as transitive deps of google-resumable-media/botocore, which is correct.

Go (go.mod, go.sum)

• go mod tidy with the repo's toolchain (go 1.25.0) produced zero diff — every direct requirement (including the non-obvious golang-migrate/migrate/v4, golang.org/x/time, otelzap, otel/log) is imported somewhere, and go.sum has no stale entries. No changes.

Sandbox setup

• Added .hoplite/settings.json with a setup script that provisions Go ≥1.25, Poetry 2.4.1, and git-lfs on fresh sandboxes — without it the repo's own task test / poetry commands cannot run (neither tool is preinstalled) and platform source-control tooling fails (git lfs missing).

Verification

• poetry check --lock passes; poetry install clean.
• All worker modules import successfully against the pruned set (worker.consumer.db, worker.storage, worker.utils.metrics, worker.__main__, …).
• Worker unit tests: 5/6 pass (python -m unittest discover -s worker/tests). The one failure is pre-existing and unrelated: test_image_pipeline.py calls process_image_file() without the content_hash argument the function requires (untouched by this PR).
• Go: go build ./... ✓, go vet ./... ✓, go test ./... -race ✓ — all packages pass except the pre-existing TestPerformanceLatencies which hard-fails without PERF_TEST_URL (an opt-in load test, also failing on current staging).

Follow-up note (not changed here)

deploy/docker/worker.dockerfile pins poetry==1.7.1, which predates PEP-621 [project] support and cannot consume the lock-version 2.1 lockfile the repo already ships. The worker image build should pin Poetry 2.x, but changing deployment infra was out of scope for this audit.