chore: python tooling and Claude Code project settings

- pinned runtime/dev deps (폐쇄망 반입용 버전 고정)
- .env.example, .gitignore
- .claude/settings.json: 시크릿/env 읽기 차단, FastAPI dev 명령 허용

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/settings.json

@@ -0,0 +1,39 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "permissions": {
+    "deny": [
+      "Read(./.env)",
+      "Read(./.env.*)",
+      "Read(**/.env)",
+      "Read(**/.env.*)",
+      "Read(**/*.pem)",
+      "Read(**/*secret*)",
+      "Read(**/secrets/**)",
+      "Read(**/.secrets/**)",
+      "Bash(env)",
+      "Bash(env *)",
+      "Bash(printenv*)",
+      "Bash(set)",
+      "Bash(export -p*)"
+    ],
+    "ask": [
+      "Bash(echo $*)",
+      "Bash(cat ./.env*)"
+    ],
+    "allow": [
+      "Bash(python -m venv *)",
+      "Bash(python -m pip *)",
+      "Bash(pip install *)",
+      "Bash(pip freeze*)",
+      "Bash(uvicorn *)",
+      "Bash(python -m uvicorn *)",
+      "Bash(pytest*)",
+      "Bash(python -m pytest*)",
+      "Bash(ruff*)",
+      "Bash(python -m ruff *)",
+      "Read",
+      "Edit",
+      "Write"
+    ]
+  }
+}