fix(deps): upgrade pyjwt, urllib3 and anyio for security advisories

[jplacht]

What and why

Resolves all 18 open Dependabot alerts (2 critical, 7 high, 9 medium). They all come from three indirect dependencies, so this is a lockfile-only upgrade. Our SimpleJWT setup (HS256 with SECRET_KEY, no JWKS) isn't hit by the PyJWT key-confusion advisories, but the nested-header RecursionError ones were reachable by anyone with a crafted Authorization header.

Changes

• pyjwt 2.13.0 → 2.15.1 (13 alerts, incl. GHSA-ffc3-869f-jxw9, GHSA-8wjv-2p76-3863, GHSA-42vr-xj54-vc7v)
• urllib3 2.7.0 → 2.8.0 (GHSA-vxq7-64xx-v4gw, GHSA-8988-9cw3-xx77, GHSA-gh4c-6fx4-qh6g)
• anyio 4.13.0 → 4.15.1 (GHSA-82r6-8w77-94w6, GHSA-5p39-cfhj-2xmp)
• typing-extensions 4.15.0 → 4.16.0, pulled in by anyio
• uv.lock only; pyproject.toml constraints unchanged

How it was verified

• ruff check, ruff format --check, ty check pass; pytest: 811 passed
• e2e stack (gunicorn + uvicorn worker, built from this branch):
  • API: login, authenticated requests and token refresh return 200
  • API: requests with no token, a tampered signature, alg=none, a bad refresh token or a deeply nested JWT header all get a 401 (the nested header no longer causes a 500)
  • Browser: logged in, opened a plan; an expired access token was refreshed transparently
  • No errors in the backend or worker logs
• Not exercised: urllib3's outbound email via Resend (e2e never sends email)

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

🟢 Coverage ∅ diff coverage · +0.00% coverage variation

Metric	Results
Coverage variation	✅ +0.00% coverage variation (-1.00%)
Diff coverage	✅ ∅ diff coverage

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (9796e21)	4891	4681	95.71%
Head commit (bb1ebdf)	4891 (+0)	4681 (+0)	95.71% (+0.00%)

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#74)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}