Move ThemeFinder into consult as a uv workspace member

[jjuritzno10]

Summary

• Copies the themefinder package into consult/themefinder/ and wires it up as a uv workspace member
• Backend resolves themefinder from the local workspace instead of PyPI, eliminating the version bump/publish/pin cycle
• Pipeline Dockerfiles (pipeline-sign-off, pipeline-mapping) install themefinder from local source via pip install ./themefinder
• Backend Dockerfile updated for workspace-aware uv sync with root pyproject.toml and lockfile
• Single root uv.lock replaces backend/uv.lock
• Makefile gains test-themefinder, test-all, and run-evals targets

What changes

Area	Before	After
themefinder dependency	PyPI version pin	uv workspace member (local source)
Lockfile	backend/uv.lock	Root uv.lock (workspace-wide)
Pipeline Dockerfiles	pip install themefinder==X.Y.Z	COPY themefinder/ && pip install ./themefinder
Backend Dockerfile	Copies only backend/	Copies workspace root config + themefinder source
Dev loop for themefinder changes	Edit → bump → publish → update pins → rebuild	Edit → it's immediately available

Verification (all pass locally)

Check	Result
uv sync workspace resolution	Pass
from themefinder.models import ThemeNode	Pass
make test-themefinder	Pass (82/82)
make test-backend	Pass (346 passed, 9 skipped)
docker build -f backend/Dockerfile .	Pass
docker build -f pipeline-sign-off/Dockerfile .	Pass
docker build -f pipeline-mapping/Dockerfile .	Pass

Follow-up PRs

• PR 2: Migrate CI workflows (themefinder tests, evals, backend trigger paths)
• PR 3: Auto-sync workflow to keep public i-dot-ai/themefinder repo in sync

Test plan

• CI passes (backend tests, pre-commit)
• Docker images build in CI pipeline
• make serve starts backend + frontend successfully
• themefinder imports work in running app

🤖 Generated with Claude Code

[aikido-pr-checks]

2 Open source vulnerabilities detected - high severity
Aikido detected 2 vulnerabilities across 2 packages, it includes 2 high vulnerabilities.

Details

Remediation Aikido suggests bumping the vulnerable packages to a safe version.

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
More info

[jjuritzno10]

Closing this as themefinder has moved on significantly in the past few days. Keeping the "PLAN" branch open.