chore(deps): refresh uv.lock (urllib3 2.7.0, GHSA-qccp-gfcp-xxvc)

[ClaydeCode]

Summary

• Bulk uv lock --upgrade to clear GHSA-qccp-gfcp-xxvc (urllib3 < 2.7.0, CVE-2026-44431, high).
• Exploit path requires low-level ProxyManager.connection_from_url().urlopen(assert_same_host=False) — not used here, but bumping clears Dependabot and protects against future regressions.
• Other notable bumps: starlette 0.46 → 1.0, sentry-sdk 2.32 → 2.59, rich 14 → 15, typer 0.16 → 0.25, uvicorn 0.35 → 0.46, websockets 15 → 16, requests 2.32.4 → 2.34.0.

Test plan

• CI green
• Smoke: shard boots, API responds, app install path still works (sandbox lacks docker-compose, so local full-suite verification was partial — 99 unit tests passed, docker/postgres-dependent tests not verifiable here)
• Spot-check starlette 0.46 → 1.0 migration notes for breaking changes in middleware / response classes

🤖 Generated with Claude Code