fix: move runtime deps to require and tooling to require-dev - #2

Problem

require and require-dev are swapped. Right now:

• require (installed in production): friendsofphp/php-cs-fixer, pestphp/pest, leafs/alchemy, leafs/sprout
• require-dev (dev only): leafs/db, leafs/date, leafs/anchor

But src/ actually uses db() (leafs/db), tick() (leafs/date), _env() (leafs/anchor) and Leaf\Sprout\Command (leafs/sprout). So a composer require leafs/billing in a real app:

• pulls pest + php-cs-fixer + alchemy into the production vendor tree
• does not guarantee db / date / anchor are present (they usually are, via leafs/leaf, which is why nobody noticed)

Fix

require:      php, leafs/anchor, leafs/date, leafs/db, leafs/sprout
require-dev:  friendsofphp/php-cs-fixer, pestphp/pest, leafs/alchemy

Only the sections move; versions are unchanged. composer.lock is gitignored so nothing else to regenerate.

Verification

• composer validate: valid
• composer install --no-dev from the new file: vendor has leafs/{anchor,date,db,fs,sprout} and no pest / php-cs-fixer
• alchemy test (dev install): 20 passed (54 assertions) — unchanged