fix: declare numpy and httpx as runtime dependencies

[smaramwbc]

numpy and httpx are imported directly by server/, but neither is declared. They arrived transitively — and one of those paths has already disappeared, so this is a live bug in the published image.

numpy — currently broken in production

server/api/admin.py imports numpy in two endpoints, unguarded:

admin.py:1491	detect_memory_conflicts() — np.array, np.linalg.norm, np.dot
admin.py:1830	memory_clusters() — np.array, np.linalg.svd, np.zeros

numpy only ever reached us through pgvector, and pgvector 0.5.0 dropped it (requires_dist is ['numpy'] on 0.4.2, None on 0.5.0). pyproject.toml already requires pgvector>=0.5.0, so numpy is now guaranteed absent:

$ uv pip compile --extra llm pyproject.toml     # current main
64 packages, numpy: 0 occurrences, pgvector==0.5.0

$ docker build -t main . && docker run --rm main python -c "import numpy"
ModuleNotFoundError: No module named 'numpy'

Both call sites early-return when there are no rows, which is why the test suite never reaches them — the endpoints raise as soon as they have data.

httpx — breaks core-only installs

server/services/webhooks.py:197 imports httpx in _attempt_delivery(). It is present only via the llm extra's dependency graph (litellm → httpx), so pip install statewave without extras resolves 34 packages with no httpx and webhook delivery raises the same way. The shipped image happens to be fine because the Dockerfile installs .[llm].

Why nothing caught it

Both imports sit inside function bodies, so they never execute at import time. Startup succeeds, pytest passes, and the container smoke test passes — the failure only surfaces on a request that reaches the code.

tests/test_runtime_imports.py closes that gap: it walks the AST of server/, collects every third-party module imported inside a function, and asserts each is importable. Modules that legitimately ship in an extra and are guarded at the call site are allowlisted (litellm; opentelemetry, which is gated behind _HAS_OTEL in server/core/tracing.py).

Verified

Check	Result
New test against an image built from main	❌ 2 failed (correctly catches the bug)
New test against this branch	✅ 2 passed
import numpy / import httpx in the built image	✅ numpy 2.4.6, httpx 0.28.1
Container boot + /healthz	✅ healthy in ~2s
Image size	132MB → 152MB (numpy)

numpy>=1.26,<3 covers the project's requires-python = ">=3.11"; the APIs in use are stable across 1.26 and 2.x.