fix(backend): pin click>=8.3.3 to clear PYSEC-2026-2132 (CI run #511)

[Sbussiso]

CI triage — run #511

Triggered by Dependabot PR #125 (bump react-dom 19.2.7 -> 19.2.8). That PR has since been merged and its branch auto-deleted, so this fix branches from master.

Two failed jobs, two root causes

Job	Step	Failure	Cause
Frontend audit + build	npm audit --audit-level=high --omit=dev	exit 1	react-router-dom 7.12.0-8.2.0, GHSA-qwww-vcr4-c8h2 (RSC-mode CSRF bypass)
Backend tests	uv run pip-audit --strict	exit 1	click 8.3.1, PYSEC-2026-2132 (fixed in 8.3.3)

Neither failure is caused by the react-dom bump. Both are pre-existing advisories that landed in their respective advisory DBs after the last green deploy.

What this PR fixes (backend — safe)

click is transitive via uvicorn (and mcp / fastmcp-slim). Adds click>=8.3.3 to [tool.uv] constraint-dependencies, matching the existing pattern (authlib, urllib3, starlette, pip, cryptography, joserfc, msgpack, pydantic-settings). Patch bump only (resolves to 8.4.2), API-compatible. Locally verified: uv run pip-audit --strict -> No known vulnerabilities found. uv lock --check passes.

What this PR does NOT fix (frontend — needs an owner decision)

The react-router-dom advisory has no safe automated fix:

• npm only suggests a downgrade to react-router-dom@7.11.0, flagged as a breaking change (manifest pins ^7.18.1).
• No patched version >= 7.12.0 exists on npm; latest is 7.18.1, still vulnerable.
• The vulnerable path is RSC (React Server Components) mode CSRF bypass. Our frontend is a Vite SPA — RSC mode is not in use — so the advisory is likely not reachable. Options: (1) suppress the advisory in CI with a non-reachability note; (2) downgrade to 7.11.0 and re-validate; (3) wait for a patched release > 7.18.1.

A commit comment with this analysis has been posted on eff42f4.

Verification

cd backend
uv lock --check          # OK
uv run pip-audit --strict
# No known vulnerabilities found

Draft so the owner can decide whether to fold in the frontend fix or merge this backend-only change first to unblock deploys.