chore(fc2a): catch up on stale dep pins — current versions across the board

Audit against PyPI revealed almost every pin in requirements.txt and
requirements-ml.txt was significantly behind. Most bumps are minor-major
catch-up; a handful are major-version jumps.

requirements.txt:
- quart       0.19  -> 0.20
- hypercorn   0.16  -> 0.18  (now declares 3.14 support)
- asyncpg     0.30  -> 0.31
- psycopg     3.2   -> 3.3
- alembic     1.13  -> 1.18  (5 minors stale)
- pgvector    0.2   -> 0.4   (2 minors stale)
- celery      5.4   -> 5.6
- redis       5.0   -> 7.4   (major jump)
- cryptography 44   -> 48
- pillow      11.1  -> 12    (major jump; 12.x has 3.14 wheels)
- gallery-dl  1.27  -> 1.32  (5 minors stale)
- python-dotenv 1.0 -> 1.2
- structlog   24.1  -> 25.5  (major jump)

(sqlalchemy 2.0 line is current. imagehash 4.3.2 was already in range.)

requirements-ml.txt (not exercised by CI yet; FC-2b territory):
- torch                 2.2  -> 2.12   (10 minors stale)
- torchvision           0.17 -> 0.27   (CAVEAT: excludes Python 3.14.1
                                        specifically — inline comment added)
- transformers          4.40 -> 5.8    (major)
- onnxruntime           1.17 -> 1.26
- huggingface-hub       0.22 -> 1.14   (major)
- opencv-python-headless 4.9 -> 4.13

The torchvision 3.14.1 exclusion is a real footgun — the python-ci
runner pulls python:3.14-bookworm (latest patch); if that ever resolves
to 3.14.1, the ml-worker image build will fail. FC-2b will exercise this
path for the first time, so the constraint is documented inline rather
than worked around now.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

requirements-ml.txt

@@ -1,9 +1,18 @@
 -r requirements.txt
 
-# ML stack
-torch>=2.2,<2.3
-torchvision>=0.17,<0.18
-transformers>=4.40,<4.41
-onnxruntime>=1.17,<1.18
-huggingface-hub>=0.22,<0.23
-opencv-python-headless>=4.9,<5.0
+# ML stack — versions current as of 2026-05-14 with Python 3.14 wheel coverage.
+
+torch>=2.12,<3.0
+
+# IMPORTANT: torchvision 0.27 declares requires_python "!=3.14.1,>=3.10" —
+# Python 3.14.1 specifically is excluded due to a known incompatibility.
+# The python-ci runner pulls python:3.14-bookworm (latest patch); if that
+# resolves to 3.14.1 the install will fail. Pin a specific Python patch in
+# the runner image (CI-Runner/CI-python/Dockerfile) if this becomes a
+# blocker. 3.14.0 and 3.14.2+ are fine.
+torchvision>=0.27,<0.28
+
+transformers>=5.8,<6.0
+onnxruntime>=1.26,<2.0
+huggingface-hub>=1.14,<2.0
+opencv-python-headless>=4.13,<5.0

requirements.txt

@@ -1,34 +1,28 @@
 # Web
-quart>=0.19,<0.20
-hypercorn>=0.16,<0.17
+quart>=0.20,<0.21
+hypercorn>=0.18,<0.19
 
 # DB
 sqlalchemy[asyncio]>=2.0,<2.1
-# asyncpg 0.30 was the first release with Python 3.13/3.14 wheels (0.29 builds
-# from source on 3.14 and fails).
-asyncpg>=0.30,<0.31
-# psycopg 3.2 stabilized the resolver story; staying on 3.1 caused pip to
-# backtrack through dozens of versions trying to find a 3.14-compatible combo.
-psycopg[binary]>=3.2,<3.3
-alembic>=1.13,<1.14
-pgvector>=0.2,<0.3
+asyncpg>=0.31,<0.32
+psycopg[binary]>=3.3,<3.4
+alembic>=1.18,<1.19
+pgvector>=0.4,<0.5
 
 # Task queue
-celery>=5.4,<5.5
-redis>=5.0,<6.0
+celery>=5.6,<5.7
+redis>=7.4,<8.0
 
-# Crypto for credential storage (lands in FC-3, but pinned now for stability).
-# 44+ aligns with current cffi/abi3 wheels under Python 3.14.
-cryptography>=44,<46
+# Crypto for credential storage (lands in FC-3, but pinned now for stability)
+cryptography>=48,<49
 
-# Image handling (lands in FC-2). 11.x is the line with Python 3.13+ wheels;
-# 10.x has no 3.14 wheel and fails to build from source.
-pillow>=11.1,<12
+# Image handling (lands in FC-2)
+pillow>=12,<13
 imagehash>=4.3,<4.4
 
 # Gallery-dl wrapper (lands in FC-3)
-gallery-dl>=1.27,<1.28
+gallery-dl>=1.32,<1.33
 
 # Utilities
-python-dotenv>=1.0,<2.0
-structlog>=24.1,<25.0
+python-dotenv>=1.2,<2.0
+structlog>=25.5,<26.0