src layout: move core code into src/tinyweb/ package

- Moved app.py, db.py, gateway.py, templates.py, embeddings.py,
  rns_client.py, and handlers/ into src/tinyweb/
- Created root app.py shim (adds src/ to sys.path, imports main)
- Created pyproject.toml with setuptools config (where = ["src"])
- Added src/tinyweb/__init__.py
- Updated all internal imports to use tinyweb. prefix (73 occurrences)
- Removed sys.path.insert hack from conftest.py
- Updated Dockerfile: pip install -e /app before running
- Updated gateway.py usage message: python -m tinyweb.gateway
- Updated README.md gateway usage instructions

tests/test_csrf.py

@@ -4,8 +4,8 @@ Every POST handler calls this to verify the submitted _csrf field matches
 the token stored in the thread-local (which is seeded from the cookie by
 `dispatch_request`). Missing or mismatched tokens must fail closed.
 """
-import handlers as handlers_module
-from handlers import _check_csrf, _csrf_field, _get_csrf_token
+import tinyweb.handlers as handlers_module
+from tinyweb.handlers import _check_csrf, _csrf_field, _get_csrf_token
 
 
 def _set_token(token):