chore: requirements.txt for Snyk (works around uv.lock unsupported)

Snyk's Python plugin doesn't yet support uv.lock files (snyk-python-plugin
#251 still open as of 2026-05-11), so the snyk PR check errors when
poetry.lock disappears in the migration. Generate requirements.txt from
uv.lock as a snyk-readable manifest until upstream support lands.

- requirements.txt: generated via `uv export --format requirements-txt
  --no-dev --no-emit-project`. Includes hashes; ~954 lines.
- .pre-commit-config.yaml: add a local hook that auto-regenerates the file
  whenever uv.lock or pyproject.toml changes. Uses `language: system` so
  it runs against whatever uv is on PATH.
- CLAUDE.md: document the workaround and the upstream issue, with a note
  to remove this once Snyk ships uv support.

Tradeoff: one auto-generated file in the repo with a clear "don't edit
by hand" mechanism. Better than carrying poetry.lock alongside uv.lock
(which would defeat the migration's purpose) or making snyk a non-blocking
check (security regression).

Co-Authored-By: Claude <noreply@anthropic.com>

Author: bluet

.pre-commit-config.yaml

@@ -39,3 +39,16 @@ repos:
             -   id: bandit
                 args: [-ll, -i, -x, tests]
                 name: bandit (security check)
+
+    # Auto-regenerate requirements.txt from uv.lock so Snyk (which doesn't
+    # yet support uv.lock — snyk/snyk-python-plugin#251) has a manifest it
+    # can scan. Local hook so it runs against whatever uv is on PATH.
+    # Only triggers when uv.lock or pyproject.toml changed.
+    -   repo: local
+        hooks:
+            -   id: uv-export-requirements
+                name: uv export → requirements.txt (for Snyk)
+                language: system
+                entry: uv export --format requirements-txt --no-dev --no-emit-project --output-file requirements.txt
+                files: ^(uv\.lock|pyproject\.toml)$
+                pass_filenames: false

CLAUDE.md

@@ -214,6 +214,7 @@ See `docs/custom_providers.md` for the full guide.
 ## Known Quirks
 
 - Build backend stays `poetry-core>=2.1.3` (poetry-core 2.x reads PEP 621 `[project]`); package management is uv (#105). PyPI publish uses `python -m build`.
+- `requirements.txt` is auto-generated from `uv.lock` via a pre-commit hook (`uv export --format requirements-txt --no-dev --no-emit-project`). It exists only because Snyk doesn't yet support uv.lock ([snyk-python-plugin#251](https://github.com/snyk/snyk-python-plugin/issues/251)). Don't edit by hand; touch `uv.lock` and let the hook regenerate it. Remove this workaround once Snyk ships uv support.
 - GeoIP database bundled in `proxybroker/data/`
 - Entry points: `__main__.py` (module), `py2exe_entrypoint.py` (executable)
 - ProxyPool.remove() is O(N log N) - acceptable for correctness