Vendor the bus_times dependency so CI (and anyone else) can build

CI has failed on every push since it was added, including all of mine —
I wrote both the workflow and the dependency and never checked the two
were compatible. `uv sync` dies with:

    failed to fetch commit ... could not read Username for github.com

because publictransporthackathon was a git+https dependency on
noamf2001/PublicTransportHackathon, which is PRIVATE. It resolves in this
devcontainer only because `gh auth login` has run here. GitHub Actions has
no such credential, and neither does anyone who clones this public repo —
so the project built on exactly one machine.

Switches the dependency to a path dep on repos/PublicTransportHackathon
and commits that source. .gitignore keeps ignoring repos/ generally (the
yuvalko1 clone is reference material with its own upstream history) and
un-ignores this one specifically, with the reason written down so the
next person doesn't "tidy it up" and break the build again. The clone has
no nested .git, so this vendors source rather than a repo-in-a-repo.

Verified: `uv sync` resolves clean, `./dev check` registers 16 analyses.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: NoamGaash

.gitignore

@@ -31,10 +31,16 @@ frontend/.vite/
 .DS_Store
 Thumbs.db
 
-# Teammates' repos, cloned for reference (./dev clone-repos). They're separate
-# git repos with their own history — vendoring them here would nest repos and
-# duplicate code we already pull in as a dependency.
+# Teammates' repos cloned for reference (./dev clone-repos) — read-only copies
+# with their own history upstream, not ours to carry.
 repos/
+# ...except PublicTransportHackathon, which is a real build dependency
+# (pyproject's publictransporthackathon points at it). It's a PRIVATE repo, so
+# a git+https dependency can't be fetched by CI or by anyone who clones this
+# public repo — vendoring the source is the only way the project builds
+# anywhere but this container. Upstream:
+# github.com/noamf2001/PublicTransportHackathon @ analyze-per-subsequent-stops
+!repos/PublicTransportHackathon/
 
 # Cached Stride API responses (re-fetchable; keeps the API healthy)
 .cache/