build(deps): consolidate the five open Dependabot updates into a single PR

[Valtora]

Pull Request

Description

Consolidates the five open Dependabot pull requests into a single mergeable PR so they can be reviewed and squash-merged in one action instead of individually. Supersedes #120, #121, #122, #123, and #124.

Bundled dependency updates:

• docker-base-images (build: bump python from d3400aa to cea0e60 in /docker in the docker-base-images group across 1 directory #120): python:3.14-slim digest d3400aa to cea0e60.
• github-actions (ci: bump the github-actions group with 3 updates #121): actions/checkout v7.0.0 to v7.0.1, actions/setup-python v6.3.0 to v7.0.0.
• npm-production (build: bump the npm-production group in /frontend with 4 updates #123): react/react-dom 19.2.7 to 19.2.8, driver.js 1.7 to 1.8, lucide-react 1.25 to 1.26.
• npm-development (build: bump the npm-development group in /frontend with 6 updates #122): @testing-library/jest-dom 6 to 7, eslint-config-next 16.2.10 to 16.2.11, tailwindcss 4.3.2 to 4.3.3, js-yaml override 4.1 to 4.3, and others.
• python-dependencies (build: bump the python-dependencies group in /requirements with 7 updates #124): openai, anthropic, google-genai, pandas, matplotlib, ruff 0.15.22 to 0.16.0, pre-commit 4.6.0 to 4.6.1.

Two changes were needed beyond the raw Dependabot commits:

1. pyproject.toml: add extend-exclude = ["bundled_models"] to [tool.ruff]. build: bump the python-dependencies group in /requirements with 7 updates #124 was failing CI on ruff format --check .. The cause is the ruff 0.15.22 to 0.16.0 bump: ruff 0.16 formats Python code blocks embedded in Markdown, so it tried to reformat the vendored bundled_models/pyannote/segmentation-3.0/README.md model card. Excluding the vendored tree is the correct fix, since it is upstream third-party content we do not own. Verified with ruff 0.16.0 locally: ruff format --check . now reports 392 files already formatted, and ruff check . passes.
2. frontend/package-lock.json: build: bump the npm-development group in /frontend with 6 updates #122 and build: bump the npm-production group in /frontend with 4 updates #123 both edit the frontend manifest and lockfile. After combining both package.json changes, the lockfile was regenerated with npm install (node 20 / npm 9, matching CI) so it is internally consistent. npm ci installs cleanly against it.

Type of change

• Bug fix (non-breaking change that fixes an issue) (the ruff exclude unblocks CI on the python group)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that changes existing behaviour)
• Documentation update

Checks run

• Backend tests: not run locally. Validated by build: bump the python-dependencies group in /requirements with 7 updates #124's own CI run (Backend tests passed); no application code changed.
• Python quality: ran ruff check . and ruff format --check . on ruff 0.16.0, both pass. mypy and the doc/Alembic validators are unaffected (no .py, docs, or migration changes).
• Frontend lint: cd frontend && npm run lint clean.
• Frontend unit tests: cd frontend && npm run test 182 passed (37 files).
• Frontend build: cd frontend && npm run build succeeded.
• Docs validation: not applicable (no docs changes).
• Alembic validation: not applicable (no migration changes).

Migration impact

• No database migration in this PR.

Documentation impact

• No documentation change required.

Security impact

• No security-sensitive change.

Manual verification

Dependency-only change. Validated the full frontend CI gate locally (npm ci, npm run build, npm run lint, npm run test) and the Python quality gate under the upgraded ruff 0.16.0 (ruff check ., ruff format --check .). No capture, context-menu, auth, or migration surfaces are touched.