Post-1175 cleanup: OpenTofu, justfile, ruff py314, valkey, modern tooling

[filippo-20tab]

Summary

Post-merge cleanup of the Django sub-bootstrapper aligned with Talos #286.

Provisioning

• Bump Vault provider ~> 4.2.0 → ~> 5.0.
• Replace Terraform with OpenTofu; rename terraform/ dir → tofu/; runner invokes tofu instead of terraform.
• Serialize TFC workspace creation via -parallelism=1 to avoid sporadic 422s on tfe_project race.

Backend template

• Switch to justfile (replaces Makefile); drop service-level docker-compose.yaml (now lives at platform level).
• Harden gunicorn.conf.py (max_requests, max_requests_jitter, workers, preload_app=False, timeout, graceful_timeout, keepalive).
• entrypoint.sh runs collectstatic --clear --link --noinput at runtime.
• Dockerfile: drop build-time collectstatic and hardcoded DJANGO_CONFIGURATION envs; local stage gets HEALTHCHECK and CMD [\"just\", \"runserver\"].
• README rewritten for uv + just flow (no more make).
• pyproject: add pytest-mock, pytest-playwright, pytest-random-order, requests-mock, types-requests to test group; add [tool.pyproject-fmt], [tool.djlint], [tool.coverage.xml]; --no-migrations --junitxml --random-order-bucket in pytest addopts; Django60 deprecation filter.
• .pre-commit-config.yaml: bump all hooks to current versions (Python {{cookiecutter.python_version}}, ruff v0.14.13, mypy v1.19.1, django-upgrade 1.29.1 targeting 5.2). Replace `pip-audit` with `uv-secure`; add `local-biome-check`; remove `prettier` and `fix-encoding-pragma`.
• Move ruff settings under [tool.ruff.lint] to silence deprecation warnings.

Misc

• Bump base requirements (`click`, `cookiecutter`, ruff to 0.14.x with Python 3.14 support).
• Rename redis → valkey across CLI, env vars, vars; keep redis~=5.0.0 as the Python package (redis-py is protocol-compatible with Valkey, simpler than swapping client).

Test plan

• Bootstrap a Django service standalone and verify justfile works
• CI pipeline runs at least up to deploy on a sandbox project