Add test suite and switch API to lifespan handler

test_entropy.py covers the HMAC-DRBG (determinism, reseed, length,
reseed limit), health checks (random passes, frozen/all-ones/short/
long-run rejected), a bit-balance smoke test on DRBG output, and the
API endpoints including auth gating. All 16 tests pass without a
camera (producer is stubbed).

Switch api.py from the deprecated @app.on_event('startup') to the
lifespan async context manager. Add pytest to requirements.txt.

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

api.py

@@ -13,6 +13,7 @@ Endpoints:
 import os
 import threading
 import time
+from contextlib import asynccontextmanager
 from datetime import datetime, timezone
 
 from fastapi import FastAPI, Header, HTTPException
@@ -29,8 +30,6 @@ API_KEY = os.environ.get("ENTROPY_API_KEY", "")
 
 NUM_BYTES = BITS // 8
 
-app = FastAPI(title="Entropy-RNG Service", version="1.0")
-
 
 class LatestBlob:
     """Thread-safe holder for the most recent entropy blob."""
@@ -76,10 +75,14 @@ def producer_loop():
         time.sleep(INTERVAL)
 
 
-@app.on_event("startup")
-def _start_producer():
+@asynccontextmanager
+async def lifespan(app):
     t = threading.Thread(target=producer_loop, daemon=True)
     t.start()
+    yield
+
+
+app = FastAPI(title="Entropy-RNG Service", version="1.0", lifespan=lifespan)
 
 
 class EntropyResponse(BaseModel):