fix(backend): pin click>=8.3.3 for PYSEC-2026-2132 (CI run #522)

[Sbussiso]

CI triage — run #522 (30308109150)

Branch `dependabot/npm_and_yarn/frontend/eslint-10.8.0` (commit `6a1d826`) failed two independent dependency-scan jobs. This PR fixes the one that has a safe automated fix and documents the other for a human decision.

---

✅ Backend — `pip-audit --strict` → FIXED in this PR

click 8.3.1   PYSEC-2026-2132   fix: 8.3.3

`click` is a transitive dep of `uvicorn` (0.51.0 pulls click 8.3.1). Added a `[tool.uv] constraint-dependencies` pin `click>=8.3.3` — the established pattern in this repo for transitive security bumps (same shape as the authlib / urllib3 / idna / starlette / pip / cryptography / joserfc / msgpack / pydantic-settings pins already in `pyproject.toml`). `uv lock` resolves to 8.4.2 (latest compatible 8.x), a patch/minor bump that is API-safe for uvicorn's decorator/argument usage.

Verified locally:

• `uv sync --extra dev` — clean
• `uv run pip-audit --strict` — `No known vulnerabilities found`
• `uv run pytest -q` — 699 passed

Remove the constraint once uvicorn's own pin moves past 8.3.3.

---

⚠️ Frontend — `npm audit --audit-level=high --omit=dev` → NOT auto-fixed (no safe fix)

react-router  7.12.0 - 8.2.0   high
GHSA-qwww-vcr4-c8h2 — React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response
react-router-dom >=7.12.0-pre.0 depends on vulnerable versions of react-router

Why no automated fix here:

1. npm's only suggested remediation is a breaking downgrade. `npm audit fix --force` wants to install `react-router-dom@7.11.0`, a major-range downgrade from the current `7.18.1`. That is a breaking change, not a safe bump.

2. An `overrides`-based bump to `react-router@8.3.0` (the fixed version) is risky at runtime. `react-router-dom@7.18.1` declares `"react-router": "7.18.1"` — an exact pin, not a range. Forcing `react-router` to 8.x via `overrides` (the repo's existing pattern for `postcss` / `js-cookie`) would let `npm audit` go green but creates an API mismatch: `react-router-dom@7.18.1` expects the `react-router@7.18.1` surface, and 8.x is a major version with breaking exports. It may compile and may even pass the build, but could fail at runtime in routing/rendering. That is not a "clear, safe fix," so I did not apply it autonomously.

3. The vulnerable path is very likely not reachable in this app. The advisory is specifically about RSC mode CSRF bypass allowing action execution before a 400 response. This frontend uses declarative ``/`` with `BrowserRouter` (`src/main.jsx`, `src/App.jsx`) — no data router (`createBrowserRouter`/`RouterProvider`), no loaders/actions, no `useFetcher`/`useSubmit`/`

   `. The CSRF-bypass-in-action-execution path requires the data/router-action machinery, which this app does not use.

Options for a human (in order of recommendation):

1. Suppress the advisory with a reachability note (cheapest, matches the actual exposure). Add an `overrides`/audit-exception entry citing that RSC/data-router actions are not used, and pin `react-router-dom` at the current `7.18.1`. Re-evaluate when the app adopts the data router.
2. Wait for a patched `react-router-dom` 7.x. The fixed `react-router` is 8.3.0; `react-router-dom`'s 7.x line is still at 7.18.1 and hasn't shipped a 7.x that pulls a non-vulnerable `react-router`. Watch for a 7.18.2 / 7.19.x patch.
3. Coordinate a major-version migration to `react-router-dom@8.x` (which pulls `react-router@8.3.0+`). This is a real upgrade effort (breaking changes in the 7→8 major) and should be its own PR, not bolted onto a dependabot eslint bump.

I've left the frontend job red on this branch intentionally — applying option 1 or 3 belongs to a deliberate human decision, not an autonomous CI-fix.

---

What this PR does

• Adds `click>=8.3.3` to `backend/pyproject.toml` `[tool.uv] constraint-dependencies` (with an inline comment matching the existing style).
• Regenerates `backend/uv.lock` (click 8.3.1 → 8.4.2).
• Unblocks the backend `pip-audit --strict` job of run #522.

Draft until reviewed — the frontend CVE decision is called out above.