Security vulnerability audit

This PR was automatically generated by the Security Audit
workflow after uv audit --output-format json reported known
vulnerabilities in the current Python dependency lockfile.

What changed

• Parsed vulnerable package names from the audit JSON output
• Ran uv lock --upgrade-package <package> for each affected package
• Updated uv.lock with the resulting non-vulnerable resolutions

Why this should not conflict with Dependabot

• This automation only touches packages with active CVEs
• It uses the dedicated security label
• It always updates the fixed branch
  security/auto-fix-vulnerabilities instead of opening duplicate PRs

Please review the dependency updates and merge if they look safe.