Fix all remaining dependency vulnerabilities

[MFA-X-AI]

Ran a full dependency audit and found a bunch of vulnerabilities across both the Python and JS stacks. Decided to clean them all up in one go.

What this PR does:

• Python side (32 vulns fixed): Bumped the minimum versions for aiohttp (→3.13.3), torch (→2.8.0), and transformers (→4.53.0) in pyproject.toml, then ran uv lock --upgrade to pull in fixed versions of all the transitive deps too — urllib3, filelock, starlette, pillow, protobuf, h11, and a handful of others.
• pnpm side (25 vulns fixed): Most were resolved with a standard pnpm update — svelte, @sveltejs/kit, storybook, and their transitive deps (minimatch, rollup, devalue, immutable) all came in clean. The last one was dompurify pulled in by mermaid, which needed a small override since mermaid hasn't updated its dependency range yet.

Both pip-audit and pnpm audit are now reporting zero vulnerabilities.