chore(deps): bundle Dependabot bumps (fastapi 0.141.1, uvicorn 0.52.0, ruff 0.16.0), sync lock

[bk86a]

Bundles #144, #145 and #146 into one review, and — critically — syncs requirements.lock.

Why bundle

Each Dependabot PR bumps only the requirement range. None touch requirements.lock, which is the file the production image installs from (Dockerfile:12-13). Merging them as-is would leave the repo self-contradictory: requirements.txt demanding fastapi>=0.141.1 while the lock still pinned fastapi==0.139.2 — a pin below its own declared floor — and the shipped image would keep building the old version.

Changes

File	Change
requirements.txt	fastapi >=0.139.2 → >=0.141.1; uvicorn[standard] >=0.51.0 → >=0.52.0
requirements-dev.txt	ruff >=0.15.22 → >=0.16.0
requirements.lock	regenerated from a clean venv

The lock was regenerated with the documented procedure (pip install -r requirements.txt && pip freeze), so besides fastapi and uvicorn it also picks up transitive drift: annotated-doc 0.0.5, annotated-types 0.8.0, anyio 4.14.2, certifi 2026.7.22, numpy 2.5.1, websockets 17.0, wrapt 2.3.0.

Note websockets crosses a major boundary (16.0 → 17.0). It arrives via uvicorn[standard] and is exercised by the image build and smoke test below.

Verification

All CI-equivalent checks run locally against the regenerated lock:

• ruff check app/ scripts/ (ruff 0.16.0) — All checks passed
• ruff format --check app/ scripts/ — 24 files already formatted
• python -c "from app.main import app" — imports OK
• pytest tests/ -q — 393 passed
• pip-audit -r requirements.lock — No known vulnerabilities found
• bandit -r app/ -c pyproject.toml — 0 issues at every severity
• docker build — succeeds
• Container smoke test — /health 200 with 830,033 postal codes loaded; /lookup correct for PL 00-001 (approximate) and DE 10115 (exact)

Closes #144
Closes #145
Closes #146