Add a test workflow, and move packaging into pyproject.toml

[huangziwei]

The CI

There was no workflow running the tests — python-publish.yml only fires on a
release. tests.yml runs the suite on push to master and on every PR, over
Python 3.11, 3.12 and 3.13, driven by uv.

No uv.lock is committed, so each run resolves dependencies afresh. That is the
deliberate choice for this repo: the reason the suite quietly rotted is that
nothing was watching upstream. A locked CI would have stayed green through
exactly the jax change that broke test_glm.py. Easy to reverse if you would
rather have reproducible runs — commit the lock and the workflow picks it up
with no edit.

The packaging

setup.cfg and requirements.txt are gone, replaced by PEP 621 metadata in
pyproject.toml.

The substantive part is that setup.cfg declared no install_requires, so
pip install rfest from PyPI installed jax, numpy, scipy, scikit-learn and
matplotlib not at all. requirements.txt was never consulted by an install.
Those are now real dependencies, and a wheel built from this branch pulls them:

Requires-Dist: jax
Requires-Dist: matplotlib
Requires-Dist: numpy
Requires-Dist: scikit-learn
Requires-Dist: scipy
Provides-Extra: contours
Requires-Dist: opencv-python; extra == "contours"

cv2 is the one dependency the code already treats as optional — rfest.check
catches the ImportError and warns that contour areas are unavailable — so it
becomes the contours extra rather than a hard requirement.

requires-python becomes >=3.11, from >=3.6. That is where the
dependencies already are: on 3.10 the resolver lands on jax 0.6.2, and the
suite behaves differently there — jnp.hstack still accepted lists that far
back, so the GLM tests pass on 3.10 and fail on everything newer.

Version stays single sourced from rfest/version.py via
[tool.setuptools.dynamic], the build backend stays setuptools, and
[dependency-groups] dev carries pytest and ruff.

This lands red, on purpose

The five tests/test_glm.py tests fail, and this PR does not touch them. All
five die on one line, jnp.hstack([0, [...]]) in GLM.compute_mle, which
current jax rejects. They are fixed in the next PR, which turns CI green.

Marking them xfail would have made this workflow report green on its first
run, and a CI that reports a state chosen for it is not worth having. The first
run should say what the suite actually does.

Verified

• The exact CI command, uv run --python X --group dev pytest tests/ -v, on
  3.11, 3.12 and 3.13: 60 passed, 5 failed on each, the 5 being the GLM
  tests above and nothing else.
• uv build and python -m build — the latter being what the release workflow
  runs — both produce a 2.1.2 wheel with the metadata above.
• Installing that wheel into an empty environment gives a working import rfest, which is what the missing install_requires prevented.
• No new ruff findings in the touched files.