build(deps): bump pypdf to 6.12.0 and tornado to 6.5.7

- pypdf 6.10.2 -> 6.12.0 (backend): includes two security fixes
  (disallow cross-ref streams with zero-only width values, avoid
  excessive whitespace in layout mode text extraction)
- tornado 6.5.5 -> 6.5.7 (evaluation, frontend): bug fixes including
  stripping auth headers on cross-origin redirects

Closes #298 (dependabot PR superseded by newer tornado release)

Signed-off-by: Jack Luar <jluar@precisioninno.com>

Author: luarss

backend/pyproject.toml

@@ -36,7 +36,7 @@ dependencies = [
     "psycopg2-binary>=2.9.11",
     "pydantic>=2.11.7",
     "pygments>=2.20.0",
-    "pypdf==6.10.2",
+    "pypdf==6.12.0",
     "rank-bm25==0.2.2",
     "rich>=13.7.0",
     "sentence-transformers>=5.1.0",