fix(backend): pin click>=8.3.3 for PYSEC-2026-2132 (CI run #528)

[Sbussiso]

What

Fixes the Backend tests / Dependency scan (pip-audit) failure from CI run #528.

(transitive via ) was flagged by PYSEC-2026-2132 (fixed in 8.3.3), failing .

Fix

Added a constraint-dependencies pin click>=8.3.3 in backend/pyproject.toml, following the existing pattern already used for authlib, urllib3, idna, starlette, cryptography, joserfc, msgpack, pydantic-settings, etc. Regenerated backend/uv.lock — uv resolves the constraint to 8.4.2 (latest compatible, within uvicorn's click range; patch/minor bump from the vulnerable 8.3.1).

Verification (local, sandbox)

• pip-audit --strict → No known vulnerabilities found ✅
• ruff check . → All checks passed ✅
• pytest -q → 699 passed ✅

Not addressed here — Frontend audit failure

The same CI run also failed Frontend audit + build / npm audit on react-router-dom GHSA-qwww-vcr4-c8h2 (high — RSC-mode CSRF bypass). This is not fixed in this PR because no safe autonomous fix exists:

• The advisory affects react-router-dom 7.12.0–8.2.0; the current ^7.18.2 (latest published) is in the affected range and no patched forward version has been released yet.
• npm's only suggested fix is npm audit fix --force, which is a breaking downgrade to 7.11.0 (7 minor versions back on a core routing dependency) — not safe to apply autonomously.
• The overrides field in package.json is used for transitive dep pins (postcss, js-cookie); there is no patched react-router-dom version to pin forward to, and pinning to 7.11.0 is the same breaking downgrade.

Reachability analysis: the advisory is specific to RSC / data-router mode (actions executing before a 400 response). This frontend uses the classic BrowserRouter + <Routes>/<Route> API exclusively — grep finds zero use of createBrowserRouter, RouterProvider, <Form>, useActionData, or useLoaderData in src/. The vulnerable path is therefore not reachable in this codebase. The npm audit --audit-level=high gate fails regardless because npm audit can't reason about reachability.

Recommendation for the frontend: either (a) wait for react-router to ship a patched release and bump, or (b) if the unreachable advisory is acceptable, relax the frontend audit gate to allow this specific advisory (e.g. npm audit --audit-level=high --omit=dev with an --allow- advisories/config exception), or (c) accept the 7.11.0 downgrade after manual testing. This is a human decision — left out of this automated CI fix.

base: master because the Dependabot branch dependabot/uv/backend/ruff-0.16.1 was squash-merged (PR #152, commit dfafc92) ~1 min before this CI run reported, so the ruff bump is already on master.