fix: SHAP version compatibility, add explainability tests, pin deps

[AmirhosseinHonardoust]

Fixes a real SHAP incompatibility and closes the remaining hygiene gaps.

Bug: modern shap (>=0.43) returns TreeExplainer.shap_values as a 3-D
array (n_samples, n_features, n_classes) instead of a per-class list.

• src/explain.py used shap_values[1] -> crashes in summary_plot.
• app.py used shap_vals[0] -> selects the wrong slice.

Fix:

• Add positive_class_shap_values() in reason_codes.py: normalizes
  legacy list / modern 3-D / 2-D inputs to the positive (fraud) class.
• Use it in explain.py (global) and app.py (single transaction).

Tests:

• tests/test_explainability.py: unit tests for the normalizer (no shap
  required) + guarded end-to-end SHAP tests that skip when shap is
  absent and run in CI where it is installed.

Deps:

• Pin requirements.txt to bounded ranges to prevent surprise major
  upgrades while keeping current versions valid.

Verified: ruff/black/mypy clean; 39/39 tests pass with shap; the
integration tests skip cleanly without it; explain.py runs end-to-end.