fix remaining dependency audit issues

[1ssb]

What changed

• upgrade FastAPI from 0.115.0 to 0.141.1
• explicitly pin patched Starlette 1.4.1
• refresh all npm dependencies allowed by the existing semver ranges

Root cause

GitHub Dependabot showed no open alerts, but an independent Python audit found nine advisory records against Starlette 0.38.6, pulled transitively by the old FastAPI pin. The npm lockfile also lagged safe in-range releases despite having no known vulnerabilities.

Impact

The backend moves onto patched FastAPI/Starlette releases. Frontend direct dependency constraints remain unchanged; only safe in-range lockfile resolutions are refreshed.

Validation

• pip-audit -r backend/requirements.txt — no known vulnerabilities
• pip-audit -r requirements-dev.txt — no known vulnerabilities
• npm audit --audit-level=low — zero vulnerabilities
• npm ls --all
• npm run build
• npm run test — 15 tests passed