fix(deps): bump deps to resolve all 9 Dependabot alerts

[1xabhay]

Summary

Bumps five vulnerable dependencies to close all 9 open Dependabot alerts (4 high, 1 moderate, 4 low). Only pyproject.toml (direct-dep floors) and uv.lock change — no source code.

Package	Before → After	Alerts cleared
starlette (direct)	1.2.1 → 1.3.1	#27 request.form() DoS (High), #26 authority poison (Low)
python-multipart (direct)	0.0.29 → 0.0.32	#24 quadratic querystring (High), #23, #22, #21 (Low)
cryptography (transitive)	47.0.0 → 49.0.0	#25 vulnerable OpenSSL in wheels (High)
msgpack (transitive)	1.1.2 → 1.2.1	#28 OOB read on Unpacker reuse (High)
pydantic-settings (transitive)	2.14.0 → 2.14.2	#29 NestedSecretsSettingsSource symlink read (Moderate)

fastapi-mail 1.6.4 → 1.6.5 came along — it pinned cryptography below 49.

Verification

Run via the Makefile targets against the Docker stack:

• make audit → No known vulnerabilities found
• make type → Success: no issues found in 33 source files
• make test → 207 passed

Note: make lint reports 27 pre-existing E501 line-too-long errors (inline-HTML f-strings in app/response/service.py and elsewhere). These exist on main and are untouched by this PR — out of scope for a dependency bump.

🤖 Generated with Claude Code