Extract per-device state out of RequestHandler (#11)

[ff225]

Closes #11. First of three steps toward #45; unblocked now that #9 has landed.

Why

RequestHandler kept every piece of runtime state in class-level dictionaries — device_profiles, variance_detector, offloading_states, _layer_sizes_cache — mutated from both the ASGI thread and the background I/O thread with no locking.

What changed

New src/server/communication/device_state.py. DeviceStateManager owns the device profiles, the EMA tables, the variance detectors, the adaptive-risk state and the layer-sizes cache, all behind one RLock.

Per-device variance detectors. The detector used to be a single class-level instance, so heterogeneous devices reporting the same layer indices polluted each other's variance statistics and skewed offloading decisions. Each device now has its own.

Thread-safety. The debug-JSON snapshot is now taken under the lock before being handed to the background writer; it previously serialized a dict that the ASGI thread could be mutating.

Backwards compatibility. RequestHandler.device_profiles remains a live view of the manager's mapping, since http_server.py:233 and the dashboard read it directly as a plain dict. No caller outside request_handler.py changes.

Drive-by cleanup. The inference-cycle telemetry path recomputed layer_sizes via _load_stats() — data already in scope — behind a hasattr() guard that was always true.

uv.lock

The first commit regenerates uv.lock, which was unparsable by uv 0.11+ and blocked every uv command, including CI's:

Dependency `google-cloud-firestore` has missing `source` field
but has more than one matching package

The package is forked across two versions by platform marker; the analysis extra listed it without a version/source to disambiguate. Regenerated with uv lock (224 packages resolved). Included here because nothing else could be verified without it.

Testing

244 passed, 1 skipped (fast suite + HTTP end-to-end). device_state.py at 100% coverage; new tests/unit/test_device_state.py covers the EMA maths, per-device isolation, snapshot copying, and an 8-thread concurrency test. ruff clean on all touched files.

Notes for the reviewer

• _load_stats is gone rather than kept as a deprecated shim: it is private and had no remaining callers.
• Two pre-existing bugs surfaced during this work and are filed separately: Edge inference times are EMA-smoothed twice, with a hard-coded alpha=0.2 #72 (edge EMA applied twice with a hard-coded alpha) and Two separate VarianceDetector instances track edge measurements; only one feeds offloading #73 (a second, never-read VarianceDetector). This PR preserves both behaviours exactly; they are fixed in the follow-up.