Relax cryptography < 46.0.0 constraint to allow security patch

[renhaa]

The constraint in requirements.txt pins cryptography < 46.0.0. This prevents upgrading to cryptography >= 46.0.5, which patches a high-severity vulnerability:

• CVE-2026-26007 — Subgroup Attack due to missing subgroup validation for SECT curves
• Advisory: GHSA-r6ph-v2qm-q3c2
• Severity: HIGH
• Fixed in: cryptography >= 46.0.5

Could you relax or remove the < 46.0.0 upper bound? If there's a known incompatibility with cryptography 46.x, happy to help test.

[renhaa]

Note: there's already an open Dependabot PR for this — #460 (bumps the constraint from < 46.0.0 to < 47.0.0). Merging that would resolve this.