fix(deps): clear all 100 known vulnerabilities; the CI red was real

`dependency_scan.sh` had been failing CI on the port branch, and it was right
to: pip-audit reported 100 known vulnerabilities across 15 packages, including
`cryptography` itself — the library doing the vault's actual encryption.

Raised the floors to the fixed versions pip-audit named. `pip-audit` on the
regenerated lock now reports zero (one ignored exception remains, the
pre-existing GHSA-wj6h-64fc-37mp).

The one that needed judgement was starlette. It was pinned `<0.48` "must
remain compatible with FastAPI", which kept seven advisories permanently open.
That ceiling predated fastapi 0.141, which requires `starlette>=0.46` with no
upper bound — so the pin was protecting against a constraint that no longer
exists. Lifting it took starlette across a major version (0.47 -> 1.6), which
is why this was verified rather than assumed:

  - 1223 Python tests pass, 171 of them API tests
  - the API app builds all 64 routes and still answers 401 for a missing
    token, a bad token, and 404 for an unknown path
  - cross_impl_check: 41/41
  - differential fuzz: no divergences

poetry.lock was regenerated too. It dated from March, and `poetry check --lock`
reported it inconsistent with pyproject.toml — CI runs `poetry install`, so
that alone would have kept the build red no matter what else was fixed.

None of this touches the TypeScript port, which has an empty production
dependency list. It matters because the Python implementation is still the
normative reference and still what a user runs today.

Also wires the differential fuzzer into ts-parity: three fixed seeds so a
regression is deterministic and bisectable, plus one seed derived from the run
id so the explored input space grows over time rather than freezing at
whatever was chosen today.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN

src/requirements.txt

@@ -1,13 +1,13 @@
 colorama>=0.4.6,<1
 termcolor>=1.1.0,<4
-cryptography>=46.0.5
+cryptography>=50.0.0
 bip-utils>=2.5.0,<3
 bech32>=1.2,<2
 coincurve>=18.0.0,<22
 mnemonic>=0.21,<1
-aiohttp>=3.13.3,<4
+aiohttp>=3.14.3,<4
 bcrypt>=4,<5
-pytest>=7,<9
+pytest>=9.0.3,<10
 pytest-cov>=4,<7
 pytest-xdist>=3,<4
 portalocker>=2.8,<4
@@ -21,9 +21,9 @@ mutmut>=2.4.4,<4
 pgpy>=0.6,<1
 pyotp>=2.8,<3
 pynacl>=1.6.2,<2
-cbor2>=5.8.0,<6
-pyasn1>=0.6.2,<1
-urllib3>=2.6.0,<3
+cbor2>=5.9.0,<6
+pyasn1>=0.6.4,<1
+urllib3>=2.7.0,<3
 pycryptodome>=3.20.0,<4
 
 freezegun>=1.5.4,<2
@@ -32,13 +32,16 @@ typer>=0.12.3,<1
 # Optional dependencies - install as needed for additional features
 pyperclip>=1.9,<2            # Clipboard support for secret mode
 qrcode>=8.2,<9               # Generate QR codes for TOTP setup
-fastapi>=0.110,<1            # API server
+fastapi>=0.141.1,<1          # API server
 uvicorn>=0.29,<1             # API server
-starlette>=0.40,<0.48        # API server (must remain compatible with FastAPI)
+starlette>=1.3.1,<2          # API server. The old <0.48 ceiling predated
+                             # fastapi 0.141, which requires starlette>=0.46
+                             # with no upper bound; keeping it pinned every
+                             # starlette advisory open.
 httpx>=0.28.1,<1             # API server
-requests>=2.32,<3            # API server
-python-multipart>=0.0.22,<0.1  # API server file uploads
-PyJWT>=2.10.1,<3             # JWT authentication for API server
+requests>=2.33.0,<3            # API server
+python-multipart>=0.0.31,<0.1  # API server file uploads
+PyJWT>=2.13.0,<3             # JWT authentication for API server
 orjson>=3.11.5,<4            # Fast JSON serialization for API server
 argon2-cffi>=21,<26          # Password hashing for API server
 toga-core>=0.5.2,<1          # Desktop GUI