fix(ci): clear cryptography + react-router CVEs blocking Test & Deploy (#538)

[Sbussiso]

CI fix for run #538 (commit 39f7d82, branch ci-fix/30854617998)

The "Test & Deploy" run failed two audit gates. This PR fixes both.

1. Backend pip-audit --strict — cryptography 48.0.1 (3 CVEs)

cryptography 48.0.1 picked up three new advisories:

CVE	Fix
CVE-2026-69248	49.0.0
CVE-2026-69249	49.0.0
CVE-2026-69247	50.0.0

These are currently unfixable. The latest clerk-backend-api (6.0.1) pins cryptography>=45.0.0,<49.0.0, so bumping the constraint to >=49.0.0 makes the dependency tree unsatisfiable (no clerk release permits cryptography ≥ 49). I tried >=50.0.0 and >=49.0.0 — both fail to resolve.

Per the workflow's own documented policy ("When a CVE shows up with no fix yet, add --ignore-vuln here with a comment citing the upstream issue and the date we plan to revisit"), I added the three ignores to both deploy.yml and weekly-deps-refresh.yml with a revisit note. Drop the ignores and bump constraint-dependencies to cryptography>=50.0.0 once clerk-backend-api raises its cap past 50.0.0.

2. Frontend npm audit --audit-level=high --omit=dev — react-router (GHSA-qwww-vcr4-c8h2)

react-router-dom ^7.18.1 pulls react-router@7.18.1, in the vulnerable range. react-router-dom has no 8.x release; the only fully-patched version is the bare react-router@8.3.0.

Since v7, the React Router team recommends importing from the unified react-router package directly (react-router-dom is deprecated). I switched the app from react-router-dom to react-router@8.3.0 and updated all 16 source files + 3 test files. All APIs the app uses (BrowserRouter, Routes, Route, Navigate, useNavigate, useParams, useLocation, Outlet, Link) are exported unchanged by v8 — no code changes beyond the import specifiers.

Verification (local)

• Backend: pytest → 699 passed; pip-audit --strict (with ignores, fresh advisory cache) → green, 3 ignored.
• Frontend: vite build → OK (172 modules); vitest → 85 passed; npm audit --audit-level=high --omit=dev → 0 vulnerabilities.

Follow-up (not in this PR)

• Watch for a clerk-backend-api release that raises the cryptography cap past 50.0.0, then remove the --ignore-vuln entries and bump the constraint.
• A Dependabot alert exists for react-router on the default branch; this PR resolves it once merged.

Draft for review — happy to split into two PRs (backend / frontend) if preferred.