Packaging: [tool.uv.build-backend] ignored by hatchling (sdist ships tests/.github); httpx & python-multipart misplaced as runtime deps

[dceoy]

Problem

Two packaging-metadata defects in pyproject.toml:

1. The [tool.uv.build-backend] table (source include/exclude) is silently ignored because the build backend is hatchling, so sdists ship repo internals the config tries to exclude.
2. httpx and python-multipart are declared as runtime dependencies but are not used by the application.

Evidence

1. pyproject.toml:53-55 sets source-include = ["mt5api/**", "LICENSE"] / source-exclude = ["tests/**"] under [tool.uv.build-backend], but [build-system] (pyproject.toml:195-197) uses hatchling.build. uv build --sdist warns explicitly:

   warning: `mt5api` defines settings for `uv_build` in `tool.uv.build-backend`, but uses `hatchling.build` as build backend instead
   

   The produced mt5api-1.0.0.tar.gz contains tests/ (22 files), .github/ (workflows, dependabot/renovate configs), .agents/, CLAUDE.md, AGENTS.md, uv.lock, and mkdocs.yml — the opposite of the configured intent.

2. grep -rn "httpx\|multipart" mt5api/ finds no usage in the package; httpx is used only by tests (tests/test_connection.py:8 and transitively by fastapi.testclient), and python-multipart is used nowhere (the API has no Form/File endpoints). Both sit in [project.dependencies] (pyproject.toml:16-17), so every production install on the Windows host pulls them for nothing.

Impact

• Published sdists are bloated with development/agent tooling files, and the build config gives a false sense of what ships.
• Unnecessary runtime dependencies enlarge the install footprint and dependency-update surface (dependabot/renovate PR noise, e.g. the recurring python-multipart bumps Bump python-multipart from 0.0.22 to 0.0.26 in the uv group across 1 directory #26/Bump python-multipart from 0.0.26 to 0.0.27 in the uv group across 1 directory #28/Bump python-multipart from 0.0.27 to 0.0.31 in the uv group across 1 directory #39/Update dependency python-multipart to v0.0.31 [SECURITY] - autoclosed #40) for packages the server never imports.

Suggested fix

• Either switch [build-system] to uv_build so [tool.uv.build-backend] takes effect, or delete that table and express the exclusions with hatchling config (e.g. [tool.hatch.build.targets.sdist] include/exclude).
• Move httpx to the dev dependency group; remove python-multipart (re-add only if a form/upload endpoint appears).

Validation

• uv build produces no backend-mismatch warning; tar tzf dist/mt5api-*.tar.gz no longer lists tests/, .github/, .agents/.
• uv sync (runtime only) followed by uv run python -c "import mt5api.main" still works; uv run pytest passes with httpx available via the dev group.