chore(deps): apply pending dependency bumps and refresh uv.lock

[n0nuser]

Description

Supersedes #181, #182, #183, #184 and #185 — merge this and those five can be closed.

Dependabot opened all five against pyproject.toml without regenerating uv.lock. Every job on each of them died at the uv sync --locked step before running a single real check:

error: The lockfile at `uv.lock` needs to be updated, but `--locked` was provided.
hint: To update the lockfile, run `uv lock`.

They are applied together here with one lock refresh rather than one at a time, because sequential lockfile regenerations conflict with each other — each merge would invalidate the next branch's uv.lock.

Dependency	Constraint	Supersedes
fastapi	>=0.115 → >=0.141.1	#182
uvicorn[standard]	>=0.34 → >=0.52.1	#181
python-multipart	>=0.0.20 → >=0.0.32	#184
tenacity	>=9 → >=9.1.4	#183
mypy (dev)	>=1.20.2 → >=2.3.0	#185

Resolution moves three locked versions: fastapi 0.139.0 → 0.141.1, uvicorn 0.51.0 → 0.52.3, mypy 2.2.0 → 2.3.0. tenacity and python-multipart were already locked at satisfying versions, so those two raise the declared floor without changing what is installed.

Note that mypy was already locked at 2.2.0, so #185's >=1.20.2 → >=2.3.0 jump is a 2.2 → 2.3 change in practice, not a 1.x → 2.x migration.

Verification

Gate	Result
uv lock	268 packages resolved, 3 updated
uv sync --locked --all-extras	clean
uv run pytest -m "not integration"	513 passed, 27 deselected, 1 pre-existing failure (see below)
uv run ruff check .	All checks passed
uv run ruff format --check .	208 files already formatted
uv run mypy localrag/ --ignore-missing-imports --no-strict-optional	no issues in 101 source files
uv run bandit -r localrag/ -ll	exit 0, 0 medium / 0 high severity

tests/test_vector_store.py::test_create_reports_unwritable_parent_directory fails in this container and is not caused by these bumps — it fails identically on clean main with the changes stashed. The container runs as uid 0, and chmod-based permission removal does not constrain root, so PersistPathError never raises. CI runs as non-root and this test passed on every PR merged today.

---

Additional context

Opened while merging the pending PR queue. #176, #178, #179, #180 and #186 were green and are already merged to main in ascending order; these five were the only ones that could not go in as-is.

The repo ruleset requires rebase merges, linear history, and up-to-date branches (strict_required_status_checks_policy), so each of the five would additionally have needed a branch update plus its own lock regeneration between merges.

---

Generated by Claude Code