build: keep pytest out of the production backend image

backend/Dockerfile

@@ -15,8 +15,12 @@ RUN adduser --disabled-password --gecos "" --uid 1001 ghostbill
 
 COPY pyproject.toml .
 
+# Test tooling is opt-in so it never ships in the production image.
+# docker-compose.test.yml sets INSTALL_TEST_DEPS=true for CI.
+ARG INSTALL_TEST_DEPS=false
 RUN pip install --no-cache-dir --upgrade pip \
-    && pip install --no-cache-dir .
+    && if [ "$INSTALL_TEST_DEPS" = "true" ]; then pip install --no-cache-dir ".[test]"; \
+       else pip install --no-cache-dir .; fi
 
 COPY . .
 

backend/pyproject.toml

@@ -16,9 +16,13 @@ dependencies = [
     "bcrypt>=4.2.0",
     "cryptography>=44.0.0",
     "python-multipart>=0.0.12",
+    "segno>=1.6.0",
+]
+
+[project.optional-dependencies]
+test = [
     "pytest>=9.0.3",
     "pytest-asyncio>=0.24.0",
-    "segno>=1.6.0",
 ]
 
 [build-system]

docker-compose.test.yml

@@ -43,6 +43,8 @@ services:
     build:
       context: ./backend
       dockerfile: Dockerfile
+      args:
+        INSTALL_TEST_DEPS: "true"
     env_file:
       - .env.test
     depends_on: