fix: remediate Trivy dependency findings (#226)

## Summary

Remediates the Trivy high findings reported for AgentEx package locks.

## Changes

- Raises backend `python-multipart` from `>=0.0.26` to `>=0.0.27` to
resolve CVE-2026-42561.
- Adds a workspace uv override for `mako>=1.3.12` so Alembic resolves
the fixed Mako release for CVE-2026-44307.
- Regenerates `public/uv.lock`, which is the lockfile consumed by
AgentEx backend Docker builds.
- Bumps AgentEx UI `vite` from `7.3.1` to `7.3.2` after a fresh Trivy
pass surfaced two Vite high findings fixed in `7.3.2`.

## Validation

- `uv lock --check`
- `uv export --frozen --no-dev --package agentex-backend
--no-emit-package agentex-backend`
  - confirmed `mako==1.3.12`
  - confirmed `python-multipart==0.0.27`
- Verified Vite lock metadata resolves to `vite@7.3.2` with npm registry
integrity.
- Reran Trivy over the AgentEx superproject worktree after this
submodule update:
  - Critical: 0
  - High: 0
  - Medium: 11
  - Low: 2

## Notes

`Mako` is not a direct runtime dependency of AgentEx; it is pulled via
Alembic. The uv override is intentional so the resolver keeps Alembic
but selects the fixed Mako version.

After disk space was recovered, reran `npm install --package-lock-only
--ignore-scripts` from `agentex-ui/`. npm completed successfully and
produced no additional lockfile drift beyond the intended `vite@7.3.2`
patch.

Author: scale-ballen

agentex-ui/package-lock.json

@@ -66,7 +66,7 @@
     "@types/react-dom": "^19",
     "@types/react-syntax-highlighter": "^15.5.13",
     "@vitejs/plugin-react": "^5.1.4",
-    "vite": "^7.3.1",
+    "vite": "^7.3.2",
     "@vitest/coverage-v8": "^4.0.6",
     "@vitest/ui": "^4.0.6",
     "eslint": "9.32.0",

agentex-ui/package.json

@@ -17,7 +17,7 @@ dependencies = [
     "alembic>=1.13.3,<2",
     "psycopg2-binary>=2.9.9,<3",
     "docker>=7.1.0,<8",
-    "python-multipart>=0.0.26",
+    "python-multipart>=0.0.27",
     "aiodocker>=0.23.0,<0.24",
     "kubernetes-asyncio>=31.1.0,<32",
     "aiohttp>=3.10.9,<4",

agentex/pyproject.toml

@@ -31,6 +31,8 @@ override-dependencies = [
     "fastapi>=0.135.0",
     "starlette>=0.52.0",
     "httpx[http2]>=0.28.1,<0.29",
+    "mako>=1.3.12",
+    "python-multipart>=0.0.27",
 ]
 
 [tool.uv.workspace]