fix(backend): clear pip-audit --strict (click/cryptography/pip CVEs)

[Sbussiso]

CI failure: run #32779432581 — Test & Deploy ❌

The Dependency scan (pip-audit) step of the Test & Deploy workflow failed with 5 known vulnerabilities in 3 packages:

Package	Version	Advisory	Fix
click	8.3.1	PYSEC-2026-2132	8.3.3
cryptography	48.0.1	PYSEC-2026-3552	50.0.0
cryptography	48.0.1	PYSEC-2026-3553	49.0.0
cryptography	48.0.1	PYSEC-2026-3554	49.0.0
pip	26.1.2	PYSEC-2026-3721	26.2

Triggered on branch dependabot/npm_and_yarn/frontend/vite-8.2.2 (PR #198, since merged to master).

Root cause

All three packages are transitive; none are imported directly by app code.

• click → pulled in by uvicorn (the only package in the tree that depends on it).
• pip → pulled in only by pip-audit itself (the dev-time scanner) to resolve deps; --strict then audits pip. It is not shipped in the app image.
• cryptography → transitive via clerk-backend-api / authlib / pyjwt. This is the non-trivial one: clerk-backend-api 6.x pins cryptography <49.0.0, so PYSEC-2026-3552/3553/3554 cannot be cleared without bumping clerk-backend-api 6 → 7 (which widens the cap to <51.0.0, allowing cryptography 50.0.0).

Fix

• clerk-backend-api>=5.0.6 → >=7.0.0 (direct dep bump — the only path to cryptography 50.0.0).
• Add transitive constraints: cryptography>=50.0.0, click>=8.3.3, bump pip>=26.1.2 → >=26.2.
• uv lock regenerated → clerk-backend-api 7.0.0, cryptography 50.0.0, click 8.4.2, pip 26.2.1.

Safety of the clerk 6 → 7 major bump

The five clerk methods this app actually calls all exist unchanged on 7.0.0:

• clerk.authenticate_request
• clerk.organizations.update
• clerk.organizations.list
• clerk.organizations.get_billing_subscription
• clerk.organization_memberships.list

The full backend test suite covers these call sites.

Local validation (reproduced the exact CI sequence)

uv sync --extra dev            -> clerk 7.0.0, cryptography 50.0.0, click 8.4.2, pip 26.2.1
uv run ruff check             -> All checks passed
uv run pip-audit --strict     -> No known vulnerabilities found
uv run pytest -v              -> 699 passed, 2 warnings

All three CI-relevant steps pass; the failing pip-audit --strict step is now green.

Notes

• Draft because this bumps a core auth dependency a major version — flagged for human review of the clerk 7.0.0 changelog before merge, even though the test suite is green.
• cryptography advisories are surfaced by pip-audit on transitive presence; the vulnerable code paths may not be reachable by this app, but --strict fails the build on their mere presence in the resolved tree.

— Hermes coder CI triage (run 32779432581)