Bump dependencies

[FWao]

Routine dependency bumps. Every pin stays exact (== / bare version); nothing was widened.

Backend

Package
openai	2.53.0 → 2.54.0	Held inside 2.x on purpose — see below
pypdf	6.15.0 → 6.16.1
pypdfium2	5.12.1 → 5.13.0
uvicorn[standard]	0.52.1 → 0.52.4
ruff	0.16.2 → 0.16.3	dev group

mkdocs-material and mkdocs-include-markdown-plugin (docs group) are already current.

Frontend

Package
@lucide/vue	1.31.0 → 1.33.0
pinia	4.0.2 → 4.0.3
vite	8.2.1 → 8.2.2
vitest	4.1.10 → 4.1.11	dev
vue-tsc	3.3.9 → 3.3.10	dev
globals	17.9.0 → 17.11.0	dev

Also npm audit fix, which lifts the transitive nanoid 3.3.17 → 3.3.18 in the lockfile (GHSA-2v37-7h3g-55p8, high). npm audit now reports 0 vulnerabilities. No direct pin changed as a result.

THIRD_PARTY_NOTICES.md regenerated — versions only, no license changes.

Two deliberately held back

openai 2.54.0, not 3.3.1. 3.0.0 makes HTTPX2 the default HTTP client and stops installing httpx. Both SDK call sites (utils/llm_detection.py, services/vision_llm_ocr.py) pass a custom httpx.AsyncClient(follow_redirects=False, timeout=…) — that client is how the repo's "no redirect following, explicit timeouts" SSRF rule is enforced on the LLM and OCR paths. Migrating means adding httpx2, rewriting both call sites, and living with both httpx generations in the image (the docling and probe clients stay on httpx v1). That is a migration with security-relevant surface, not a version bump, so it belongs in its own PR.

typescript 6.0.3, not 7.0.2. package.json already documents why: typescript-eslint 8.x requires typescript <6.1.0, and vue-tsc has no TS 7 support. Left alone.

Verification

uv run ruff check + format --check, 381 pytest, npm run check, npm run build, 12 Playwright e2e — all pass.

The 12 pre-existing Vitest failures in useLocale/settings are unchanged (Node's localStorage needs --localstorage-file); everything else is green at 127 passed, and no new failures appeared. pip-audit could not bootstrap locally, so the Python side is left to the security.yml workflow.