fix(docker): install only the main dependency group in the image

[joszz]

The Dockerfile runs poetry install --no-root, which also installs the dev group. Every published image ships pytest, mypy, pylint, ruff, pre-commit and their dependencies in /usr/src/app/.venv, 31 packages that never run in the container. This adds --only main.

Why

• Image scanners flag the dev tools all the same. Trivy reports virtualenv 21.3.1 (pulled in by pre-commit) in saicismartapi/saic-python-mqtt-gateway:0.12.0 for CVE-2026-102925, CVE-2026-102930 and CVE-2026-102937 (high) and CVE-2026-102938 (medium). Anything built on the image inherits those alerts.
• The image doesn't need them. CI runs mypy, ruff and pytest on the runner (build_and_test_python.yml), not inside the image.
• Smaller image. In a local Python 3.14 venv, site-packages drops from 73 MB to 17 MB.

Runtime versions don't change: --only main installs from the same poetry.lock.

Testing

On develop with Poetry 2.3.2 and Python 3.14:

• poetry install --no-root --only main installs the 17 packages of the main group and nothing else.
• python -c "import main" from src/ succeeds against that venv. main.py pulls in every module except log_config, which only uses the standard library.

I haven't built the Docker image itself, and PR CI only runs the Python tests, so the image build is still untested.

🤖 Generated with Claude Code

[nanomad]

Merged into develop. Thanks for the fix.

Verified before merging:

• Built the image from this PR's head. The build succeeded.
• import main works inside the container.
• pytest, mypy, ruff, pylint, pre-commit and virtualenv are no longer in .venv.
• CI passed on Python 3.12, 3.13 and 3.14.