fix: use uv pip install in CI to avoid resolving hanzo-kms extra

uv sync resolves ALL extras including hanzo (which depends on
hanzo-kms, not published to PyPI) even with --no-extra flag.
Switch to uv pip install -e ".[dev]" which only resolves the
specified extras.

.github/workflows/ci.yml

@@ -50,7 +50,9 @@ jobs:
 
       - name: Install dependencies
         working-directory: ./api
-        run: uv sync --extra dev --no-extra hanzo
+        run: |
+          uv venv
+          uv pip install -e ".[dev]"
 
       - name: Run tests
         working-directory: ./api
@@ -125,7 +127,9 @@ jobs:
 
       - name: Install API dependencies
         working-directory: ./api
-        run: uv sync --extra dev --no-extra hanzo
+        run: |
+          uv venv
+          uv pip install -e ".[dev]"
 
       - name: Start API server
         working-directory: ./api