fix(setup): prove the venv works, and fix the dev install it was faking

`make setup` exited 0 whether or not the environment worked (D-24) — and
it turns out it didn't: `pip install -e ".[dev]"` targeted a `[dev]`
extra that pyproject.toml has never declared, so pip only warned and
silently installed zero dev dependencies. Discovered by the new check
on its first run against a clean venv.

Switch the install to `-r requirements-dev.txt -e .`, the real dev
dependency list, and end setup with `pytest --collect-only` — it
exercises the whole import graph (src.main, every domain, every
dev/test dependency pytest itself needs), so it fails the target on a
missing dependency instead of reporting success for an unusable env.

setup still covers webber-api only; webber-cli and webber-sandbox have
their own pyproject.toml/venv and are flagged, not silently included
(T-47).

Makefile

@@ -21,8 +21,30 @@ help: ## Show this help
 	  | awk 'BEGIN{FS=":.*?## "}{printf "  \033[36m%-14s\033[0m %s\n", $$1, $$2}'
 
 .PHONY: setup
-setup: ## Create the webber-api venv and install dev dependencies
+# Covers webber-api only. webber-cli and webber-sandbox each have their own
-	cd $(API) && $(PYTHON) -m venv .venv && .venv/bin/pip install -e ".[dev]"
+# pyproject.toml and venv but are not wired in here — that reads as an
+# omission rather than a decision: no ticket or decision record excludes
+# them, and their .venvs on disk predate this target and were built by hand.
+# Flagged here rather than silently extended — T-47's scope is verification
+# of what setup already covers, not widening what it covers.
+setup: ## Create/converge the webber-api venv and prove it's usable (T-47)
+	cd $(API) && $(PYTHON) -m venv .venv && .venv/bin/pip install -r requirements-dev.txt -e .
+	@# The prior line read `pip install -e ".[dev]"`, but pyproject.toml
+	@# declares no [dev] extra and never has (checked full history) — pip
+	@# only warns ("does not provide the extra 'dev'") and installs the
+	@# bare package, so `setup` silently produced a venv with no pytest,
+	@# ruff or mypy. requirements-dev.txt (which -r's requirements.txt) is
+	@# the real dev dependency list; this is what it was presumably meant
+	@# to install. Found by the check below, which failed on the very
+	@# first run against a clean venv (T-47).
+	@# Exit 0 from pip install is not evidence the env is usable (D-24) — a
+	@# step whose job is to not fail has a passing state indistinguishable
+	@# from its broken state. collect-only exercises the real import graph
+	@# (src.main, every domain, every dev/test dependency pytest itself
+	@# needs), not just one module import, so it catches a missing dev
+	@# dependency the same as a broken package import — and fails the
+	@# target when it does.
+	cd $(API) && .venv/bin/python -m pytest tests/ --collect-only -q
 
 .PHONY: test
 test: ## Run the webber-api test suite