fix(backend): bump click >=8.3.3 for PYSEC-2026-2132 (CI #509 backend half)

[Sbussiso]

CI triage — run #509 (30306860966)

workflow_run for Test & Deploy on dependabot/npm_and_yarn/frontend/eslint-10.8.0 failed with two independent audit-gate failures, both newly-disclosed CVEs hitting an existing branch (neither caused by the eslint bump in this PR):

1. Backend — pip-audit --strict ❌ → ✅ fixed in this PR

• click 8.3.1 flagged by PYSEC-2026-2132 (transitive via uvicorn).
• Fix: 8.3.3. Patch bump within 8.3.x — API-compatible.
• Fix applied: added "click>=8.3.3" to [tool.uv] constraint-dependencies in backend/pyproject.toml, following the existing pattern (authlib, urllib3, idna, starlette, cryptography, joserfc, msgpack, pydantic-settings). uv.lock updated: click 8.3.1 → 8.4.2.
• Verified locally:
  • uv lock → resolved cleanly
  • uv run pip-audit --strict → No known vulnerabilities found (exit 0)
  • uv run ruff check → All checks passed
  • uv run pytest -q → 699 passed

2. Frontend — npm audit --audit-level=high --omit=dev ❌ → NOT fixed here (no safe fix)

• react-router 7.18.1 flagged by GHSA-qwww-vcr4-c8h2 — "RSC Mode CSRF Bypass Allows Action Execution Before 400 Response" (high, CWE-352). Affects react-router >=7.12.0 <8.3.0.
• We are on 7.18.1, the latest 7.x release — there is no patched 7.x.
• The only patched version is react-router@8.3.0, a SemVer major bump. In v8 the react-router-dom package was removed (no 8.x release exists) and exports were restructured (BrowserRouter/Routes/Link/useNavigate etc. moved to the ./dom subpath). The codebase imports from react-router-dom in 12 files (App.jsx, main.jsx, 8 page components, 4 shared components) — migrating to v8 requires editing all of them and re-testing the entire SPA navigation surface.
• npm's only suggested "fix" (react-router-dom@7.11.0) is a downgrade that would reopen 3 already-fixed advisories: build(deps-dev): bump vite from 8.0.7 to 8.0.16 in /frontend #17 (RCE, fix 7.14.2), build(deps): bump python-multipart from 0.0.27 to 0.0.31 in /backend #18 (open redirect, fix 7.14.1), build(deps): bump starlette from 1.2.0 to 1.3.1 in /backend #19 (DoS, fix 7.15.0). Not acceptable.
• Reachability note: the vulnerable path is RSC (React Server Components) mode CSRF bypass. This app is a client-rendered Vite SPA using BrowserRouter — it does not use RSC mode / framework routes, so the vulnerable code path is likely not reachable. A short-term option is to document non-reachability and temporarily relax the gate (--audit-level=critical or --ignore-vuln GHSA-qwww-vcr4-c8h2 with a revisit date) until a proper v8 migration is scheduled. That's a policy decision for the owner, so I left it out of this PR.

What this PR does

• Fixes the backend half (the safe, in-range fix).
• Leaves the frontend half for a separate decision (major-version migration vs. documented non-reachability + temporary gate relaxation).

Recommendation for the frontend

Either (a) schedule a react-router v7→v8 migration as its own PR (touches 12 files + full nav re-test), or (b) if RSC mode is confirmed unreachable, add --ignore-vuln GHSA-qwww-vcr4-c8h2 to the npm audit step in .github/workflows/deploy.yml with a comment + revisit date, matching the pattern already documented in the workflow comments.

---

Auto-triaged by Hermes coder from the workflow_run webhook for run #509.