fix: Harden fresh installs against undeclared dependencies

[kw-datamasque]

Follow-up to the v1.4.0 fresh-install breakage, stacked on #18.

What happened

Every fresh install of 1.4.0 crashed at startup.
main.py imported click without declaring it as a dependency; click had always been pulled in by typer, and typer 0.27.1 stopped depending on it, so new installs got no click and dm died on its first import.
CI stayed green because every job installs from uv.lock, which still held an older typer that shipped click.
Existing installs kept their click, so only fresh installs broke.

Warning

rich is in exactly the position click was: imported by our code, undeclared, and currently arriving only through typer.
If typer drops rich the way it dropped click, every fresh install breaks again with no commit in this repo.
#18 fixed the click import; this PR closes the rest of the class.

Changes

• Declare rich as a real dependency.
• Raise the typer floor to 0.16.0.
  typer==0.15.0 crashes with the click versions installs get today, so the old floor advertised a combination that cannot work.
  The new minimums were install-tested together by hand on Python 3.11; no CI job re-checks them.
• Add upper bounds to typer and tomli-w.
• Add deptry to lint (CI and make lint): fails when src imports a package pyproject.toml does not declare.
  It parses the AST, so it catches imports inside functions too.
• Add a fresh-install smoke test: build the wheel, install it into a clean Python 3.11 venv, import every module, run dm --help.
  Runs on every PR and before every publish.
  It lives in scripts/installation_smoke_test.sh, so make smoke runs the identical check locally, and its header records what it does not cover.
  The main test job already covers Python 3.11/3.12/3.13; the smoke test only proves a clean install works, and 3.11 is the oldest supported floor, the end that breaks first.

Why not pin exact versions

== pins conflict with users' other tools, still let indirect dependencies float, and block upstream security fixes until we re-release (typer and rich do not backport fixes to old versions).
Declaring every imported package closes this incident class outright; deptry keeps it closed.

[ClassicMMT]

Good job! I like the idea.

A few things to consider/finish:

Needs target branch updated

1. CHANGELOG.md needs to be updated.
2. Should there be enable-cache: true on setup-uv?
3. Should make check include smoke tests?

Also should this be in other repos too?