chore: bump all dependencies to latest versions

[LukeMainwaring]

Summary

Routine dependency refresh (run via /updating-deps). All backend and frontend dependencies bumped to latest, with refreshed AI library documentation. No source-code changes — the update is dependency files + docs only.

Backend (direct)

• pydantic-ai 1.103.0 → 1.106.0
• uvicorn 0.48.0 → 0.49.0
• ruff (dev) 0.15.15 → 0.15.16
• Transitive churn: openai 2.38→2.41, mcp, logfire, starlette, etc.

Frontend (direct)

• ai 6.0.192 → 6.0.199, @ai-sdk/react 3.0.194 → 3.0.201, @ai-sdk/gateway 3.0.121 → 3.0.127
• next 16.2.6 → 16.2.9, react / react-dom 19.2.6 → 19.2.7
• @tanstack/react-query 5.100.14 → 5.101.0, @auth0/auth0-react 2.17.0 → 2.18.0
• axios 1.16.1 → 1.17.0, date-fns 4.3.0 → 4.4.0, radix-ui 1.4.3 → 1.5.0 (+ @radix-ui/* patch bumps)
• @hey-api/openapi-ts (dev) 0.97.3 → 0.98.2, plus geist, @vercel/functions, use-stick-to-bottom, type defs, tsx, ultracite, @tailwindcss/typography

Docs

• Refreshed docs/pydantic-ai-llms-full.txt
• Vercel AI SDK UI docs reassembled byte-identical (no change)

Notable (no action required)

• pydantic-ai 1.106 includes a VercelAIAdapter confused-deputy security fix — directly relevant since chat routes through dispatch_request; now applied.
• axios 1.17 adds prototype-pollution hardening.
• No breaking changes affect this codebase.

Validation

• ✅ Backend pre-commit run --all-files — ruff, ruff-format, mypy all pass
• ✅ Frontend ultracite check — 65 files, no errors

Suggested follow-ups (manual)

• Re-run pnpm -C frontend generate-client to confirm the openapi-ts 0.98 "declarative config" bump regenerates cleanly (output should be unaffected).
• If deployed behind a proxy, sanity-check client-IP/scheme detection given uvicorn 0.49's ProxyHeadersMiddleware change (now consumes duplicate forwarding headers again).

🤖 Generated with Claude Code