fix(deps): pin click>=8.3.3 to clear PYSEC-2026-2132 (CI run #30306866673)

[Sbussiso]

CI failure being fixed

Failed run: #30306866673 — Test & Deploy
Branch: dependabot/uv/backend/fastapi-0.140.7 (merged to master as PR #131 / commit a66b071, branch since deleted) · Commit: f89011f
Failing job/step: Backend tests → Dependency scan (pip-audit)

Note on scope: this run actually had two failing jobs — Backend tests (pip-audit, click) and Frontend audit + build (npm audit, react-router). This PR fixes the backend one, which has a clear & safe fix. The frontend one does not — see the commit comment on f89011f for the react-router root-cause analysis and why it needs human judgment.

Root cause

pip-audit --strict failed with:

Found 1 known vulnerability in 1 package
Name  Version ID              Fix Versions
click 8.3.1   PYSEC-2026-2132  8.3.3

click is a transitive dependency — pulled in by uvicorn, which declares click with no version specifier. uv therefore resolved it to 8.3.1, the version flagged by:

• PYSEC-2026-2132 / CVE-2026-7246 / GHSA-47fr-3ffg-hgmw
• Command injection in click.edit(), fixed in 8.3.3

No app code calls click.edit() (it's a CLI helper used by uvicorn's launcher), so the vulnerable path isn't reachable in this service — but pip-audit --strict is a deploy gate and correctly fails the scan.

Fix

Add click>=8.3.3 to [tool.uv].constraint-dependencies in backend/pyproject.toml so the resolver floors the transitive click at a non-vulnerable version. uv re-locked click 8.3.1 → 8.4.2. No top-level dependency change. Constraint is removable once uvicorn pins click>=8.3.3 itself (currently unbounded) or the advisory is withdrawn.

Verification

$ cd backend && uv sync --extra dev && uv run pip-audit --strict
Updated click v8.3.1 -> v8.4.2
No known vulnerabilities found
$ uv run ruff check .
All checks passed!

Files changed

• backend/pyproject.toml — add click>=8.3.3 constraint (+13 lines, matching the style of the existing transitive-constraint block)
• backend/uv.lock — click bumped 8.3.1 → 8.4.2 + constraint registered in [manifest].constraints

Why a fresh PR (the #116–#121 history)

Draft PRs #116–#121 (2026-07-20) all attempted this same click pin, but each targeted a dead ci-fix/* branch that never landed, so click is still 8.3.1 on master and the strict scan keeps failing on every run. This PR targets master directly so the fix actually lands.

---

Auto-triaged by Hermes coder from CI failure webhook (run #30306866673).