chore(deps-dev): update fastapi requirement from <0.138.2,>=0.100.0 to >=0.100.0,<0.139.1 (#189)

* chore(deps-dev): update fastapi requirement

Updates the requirements on [fastapi](https://github.com/fastapi/fastapi) to permit the latest version.
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.100.0...0.139.0)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.139.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

* build: actually exclude fastapi 0.136.3 flagged by MAL-2026-4750

The adjacent comment claims the advisory version is excluded, but the
range specifier alone never did. Add !=0.136.3 to the web and dev
extras so a constrained resolve cannot pick the flagged release.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TqYpmV8TABMzq27HBTLtNP

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Patrick Roland <48327651+rolandpg@users.noreply.github.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: 3 people

pyproject.toml

@@ -90,7 +90,7 @@ extensions = [
 # Web UI (ZettelForge)
 web = [
     # Exclude 0.136.3 while PyPI advisory MAL-2026-4750 is active.
-    "fastapi>=0.100.0,<0.138.2",
+    "fastapi>=0.100.0,!=0.136.3,<0.139.1",
     "uvicorn>=0.20.0",
     "psutil>=5.9.0",
     "jinja2>=3.0.0",
@@ -136,7 +136,7 @@ dev = [
     "ruff>=0.4.0",
     "langchain-core>=0.2.0",
     # Exclude 0.136.3 while PyPI advisory MAL-2026-4750 is active.
-    "fastapi>=0.100.0,<0.138.2",  # for test_web_api.py
+    "fastapi>=0.100.0,!=0.136.3,<0.139.1",  # for test_web_api.py
     "uvicorn>=0.20.0",      # for test_web_api.py
     "psutil>=5.9.0",        # for test_web_api.py
     "jinja2>=3.0.0",        # for test_web_api.py