Fix dev compose: API PYTHONPATH and web volume permissions

API: bake ENV PYTHONPATH=/app/src into the development Dockerfile stage
so it's available to uvicorn's WatchFiles reloader subprocess — relying
on compose env vars isn't reliable across process forks.

Web: replace ./web:/app bind mount (caused EACCES in Podman rootless due
to UID mismatch) with ./web/src:/app/src — this preserves the container's
package.json and node_modules while still giving Vite live access to
source files for HMR.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/Dockerfile

@@ -3,6 +3,7 @@ WORKDIR /app
 RUN pip install uv
 
 FROM base AS development
+ENV PYTHONPATH=/app/src
 COPY pyproject.toml .
 RUN uv sync
 COPY . .