Bump vulnerable transitive deps to clear required `audit` check (blocks #124, #125)

[millsmillsymills]

Problem

The audit CI job (uv run pip-audit) is a required status check on phase1 and is currently red on the base branch. This blocks every PR from merging — confirmed blocking #124 and #125.

pip-audit on phase1 reports 8 vulnerabilities across 5 packages. Dependabot #124 (fastmcp 3.4.2, etc.) clears msgpack and pydantic-settings transitively, leaving these three:

Package	Current	Fix	CVE/Advisory
cryptography	48.0.0	48.0.1	GHSA-537c-gmf6-5ccf
python-multipart	0.0.29	0.0.31	CVE-2026-53538/53539/53540
starlette	1.2.0	1.3.1	CVE-2026-54282/54283

All three are transitive (pulled via fastmcp/mcp/sse-starlette), so they fall outside the Dependabot dependencies group and won't be bumped by #124.

Fix

Add explicit floors / lockfile bumps for the three packages so uv.lock resolves to the fixed versions, then re-run uv run pip-audit until clean. Verify the non-integration suite (uv run pytest -m "not integration") still passes — starlette 1.2→1.3 is a minor bump worth a smoke check given the WiFi/HTTP transport path.

Unblocks

• chore(deps): Bump the dependencies group across 1 directory with 6 updates #124 — dependabot deps bump (audit will then pass alongside this)
• docs: tool↔schema coverage matrix with drift test #125 — tool↔schema matrix docs (audit is its only red check)

Note: phase1 enforces required_signatures + required_linear_history; merge via squash (GitHub-signed) per the repo's signing constraints.