fix(deps): pin click/cryptography/pip past 2026-08 advisories (CI red on #203) - #207

Why

CI run 32779491429 (the Test & Deploy check on dependabot PR #203) failed at the Dependency scan (pip-audit) step — uv run pip-audit --strict reported 5 known vulnerabilities in 3 transitive packages:

These advisories landed in the PyPA Advisory DB after the last green deploy — no application code changed. All three are transitive:

• click via uvicorn
• cryptography via clerk-backend-api / authlib
• pip via pip-audit itself (dev/CI surface only; not shipped in the app image)

What

Follows the existing constraint-dependencies pattern in backend/pyproject.toml: bump the version floor so uv resolves past the vulnerable version, with a comment citing the advisory + date, to be removed once a direct dep's own pin clears.

• click 8.3.1 → 8.4.2 (new constraint, was unconstrained)
• cryptography 48.0.1 → 50.0.0
• pip 26.1.2 → 26.2.1

Lock regenerated with uv lock.

Verification (local, same gates as deploy.yml)

pip-audit --strict  → No known vulnerabilities found   ✓ (was 5 vulns)
ruff check          → All checks passed!              ✓
pytest -q           → 699 passed, 2 warnings          ✓

Notes

• The original failing branch dependabot/uv/backend/sqlalchemy-2.0.52 was merged as build(deps): bump sqlalchemy from 2.0.51 to 2.0.52 in /backend #203 seconds after the failure was recorded (squash-merge a0d637c), so the vulnerable lock is now on master — this PR targets master.
• A commit comment with the diagnosis has also been posted on the original failing commit fbba124.