Roll up the remaining gemini-nano dependency updates

[OgeonX-Ai]

Summary

Roll up the remaining gemini-nano dependency updates that were left open after the provenance and workflow merges changed the same files.

Changes

• update api-server/requirements.txt to allow fastapi>=0.139.0 and httpx>=0.28.1
• update chrome-bridge/package.json and package-lock.json for express@^5.2.1
• replace three conflicting single-package PRs with one repo-owned branch based on current master

Why

Dependabot PRs #1, #3, and #4 all became conflicting after the provenance rollout and the earlier dependency merges changed the same files. This PR reapplies those still-desired dependency bumps on top of the current default branch.

Validation

• api-server: repo-local venv install, ruff check ., pytest -q -s test_server.py
• chrome-bridge: npm install
• chrome-bridge: local npm test is not authoritative on this workstation because Node is 18.19.1 while the already-merged puppeteer-core@25.3.0 path expects Node >=22.12.0; the same health test previously passed in GitHub Actions on Node 22.23.1

Risks

• express is a semver-major bump and could still surface runtime differences outside the existing health check coverage
• final acceptance for the Node slice depends on GitHub Actions using the repo's intended Node 22 runtime

Related

• Supersedes Dependabot PRs #1, #3, and #4
• Follows merged PRs #9, #10, #7, #6, #5, and #2

Reviewer notes

Start with api-server/requirements.txt and chrome-bridge/package.json, then verify the regenerated package-lock.json and the CI runs on this branch.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3172f03b18

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Guard empty request bodies after Express 5

When this dependency bump takes the bridge to Express 5, req.body is now undefined whenever express.json() does not parse a body, whereas Express 4 defaulted it to {}; the ready Chrome path in server.js still dereferences req.body.messages directly. A POST /v1/chat/completions with no body or a non-JSON content type will therefore throw and return a 500 instead of following the existing fallback behavior (messages || []) or returning a controlled client error, so the route should coerce req.body before reading from it.

Useful? React with 👍 / 👎.