chore(deps): relock requirements, supersede #50

[0xzerolight]

What

Relock requirements.txt / requirements-dev.txt off main. Supersedes #50.

Why

Dependabot #50 fails CI at the Install dependencies step (not ruff/mypy):

pip install --require-hashes -r requirements-dev.txt
ERROR: ResolutionImpossible
  The user requested typer==0.26.8
  huggingface-hub 1.21.0 depends on typer<0.26.0 and >=0.20.0

huggingface-hub 1.22.0 drops the typer<0.26.0 cap (typer moved to an optional
extra upstream), so a fresh pip-compile --upgrade resolves typer 0.26.8 and
hf-hub 1.22.0 together.

What's in

typer 0.25.1→0.26.8, huggingface-hub 1.21.0→1.22.0, filelock 3.29.4→3.29.5,
typing-extensions 4.15.0→4.16.0, and (dev) coverage 7.14.3→7.15.0.

What's deliberately left out

#50 was inconsistent on all four of its bumps, not just typer. These three stay
at current because the latest allowed litellm/instructor still cap them:

package	#50 wanted	held at	capped by
importlib-metadata	9.0.0	8.9.0	litellm 1.90.2 (<9.0)
jiter	0.16.0	0.14.0	instructor 1.15.4 (<0.15)
rich	15.0.0	14.3.4	instructor 1.15.4 (<15.0)

Verification

Locally with the new hash-locked deps installed on Python 3.11:

• pip install --require-hashes -r requirements-dev.txt — succeeds (the exact CI failure)
• ruff check . — passed
• ruff format --check . — clean
• mypy app/ --ignore-missing-imports — no issues, 68 files
• pytest --tb=short — 1588 passed, coverage 93.64% (≥85% gate)