fix: patch Python CVEs in backend, frontend, and evaluation (#286)

fix: patch Python CVEs in all pyproject.toml and uv.lock files

Fixes the following CVEs by bumping minimum version constraints:
- aiohttp: 3.13.4 -> 3.14.0 (CVE-2026-34993, CVE-2026-47265)
- pyarrow: 19/20/21.x -> 23.0.1+ (PYSEC-2026-113)
- pygments: 2.19.2 -> 2.20.0 (CVE-2026-4539)
- PyJWT: 2.12.1 -> 2.13.0 (PYSEC-2026-175/177/178/179)
- starlette: 0.46/0.50.x -> 1.2.1 (PYSEC-2026-161, CVE-2025-54121, CVE-2025-62727)
- fastapi: 0.115.14 -> 0.136.3 (frontend, to pull in starlette 1.x)

aiohttp and pyarrow are added as explicit constraints to force
transitive dependency updates. torch 2.9.0 (PYSEC-2026-139) has no
upstream fix available yet.

https://claude.ai/code/session_01GeF1r9TL34WDNuRp3ny8iR

Co-authored-by: Claude <noreply@anthropic.com>

Author: luarss

backend/pyproject.toml

@@ -5,7 +5,9 @@ description = "Add your description here"
 readme = "README.md"
 requires-python = ">=3.13"
 dependencies = [
+    "aiohttp>=3.14.0",
     "asyncpg>=0.30.0",
+    "pyarrow>=23.0.1",
     "cryptography>=46.0.5",
     "faiss-cpu==1.12.0",
     "fastapi>=0.117.0",
@@ -30,10 +32,10 @@ dependencies = [
     "nltk==3.9.4",
     "openai==1.100.2",
     "protobuf>=5.29.6",
-    "PyJWT>=2.12.0",
+    "PyJWT>=2.13.0",
     "psycopg2-binary>=2.9.11",
     "pydantic>=2.11.7",
-    "pygments>=2.15.1",
+    "pygments>=2.20.0",
     "pypdf==6.10.2",
     "rank-bm25==0.2.2",
     "rich>=13.7.0",
@@ -46,7 +48,7 @@ dependencies = [
     "sphinx-external-toc==1.0.1",
     "sphinxcontrib-mermaid==1.0.0",
     "sqlalchemy>=2.0.43",
-    "starlette>=0.49.1",
+    "starlette>=1.0.1",
     "unstructured==0.18.18",
 ]