SECURITY: Pin litellm to safe versions (supply chain attack)

litellm PyPI versions 1.82.7 and 1.82.8 were compromised by attacker
TeamPCP with credential-stealing malware. See:
BerriAI/litellm#24518

Pinned to known-safe versions:
- backend: litellm==1.82.1
- notebooks: litellm==1.82.6

Do NOT upgrade until BerriAI confirms PyPI is clean.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: abossard

backend/requirements.txt

@@ -14,5 +14,5 @@ langchain-openai>=0.3.0
 jsonschema>=4.20.0
 pandas>=2.0.0
 APScheduler>=3.10.4
-litellm>=1.50.0
+litellm==1.82.1
 langchain-litellm>=0.3.0

notebooks/requirements.txt

@@ -1,5 +1,5 @@
 dspy>=2.6.0
-litellm>=1.50.0
+litellm==1.82.6
 python-dotenv>=1.0.0
 ipywidgets>=8.0.0
 plotly>=5.18.0