chore(fc2a): catch up on stale dep pins — current versions across the board

Audit against PyPI revealed almost every pin in requirements.txt and
requirements-ml.txt was significantly behind. Most bumps are minor-major
catch-up; a handful are major-version jumps.

requirements.txt:
- quart       0.19  -> 0.20
- hypercorn   0.16  -> 0.18  (now declares 3.14 support)
- asyncpg     0.30  -> 0.31
- psycopg     3.2   -> 3.3
- alembic     1.13  -> 1.18  (5 minors stale)
- pgvector    0.2   -> 0.4   (2 minors stale)
- celery      5.4   -> 5.6
- redis       5.0   -> 7.4   (major jump)
- cryptography 44   -> 48
- pillow      11.1  -> 12    (major jump; 12.x has 3.14 wheels)
- gallery-dl  1.27  -> 1.32  (5 minors stale)
- python-dotenv 1.0 -> 1.2
- structlog   24.1  -> 25.5  (major jump)

(sqlalchemy 2.0 line is current. imagehash 4.3.2 was already in range.)

requirements-ml.txt (not exercised by CI yet; FC-2b territory):
- torch                 2.2  -> 2.12   (10 minors stale)
- torchvision           0.17 -> 0.27   (CAVEAT: excludes Python 3.14.1
                                        specifically — inline comment added)
- transformers          4.40 -> 5.8    (major)
- onnxruntime           1.17 -> 1.26
- huggingface-hub       0.22 -> 1.14   (major)
- opencv-python-headless 4.9 -> 4.13

The torchvision 3.14.1 exclusion is a real footgun — the python-ci
runner pulls python:3.14-bookworm (latest patch); if that ever resolves
to 3.14.1, the ml-worker image build will fail. FC-2b will exercise this
path for the first time, so the constraint is documented inline rather
than worked around now.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

requirements-ml.txt

@@ -1,9 +1,18 @@
 -r requirements.txt
 
-# ML stack
-torch>=2.2,<2.3
-torchvision>=0.17,<0.18
-transformers>=4.40,<4.41
-onnxruntime>=1.17,<1.18
-huggingface-hub>=0.22,<0.23
-opencv-python-headless>=4.9,<5.0
+# ML stack — versions current as of 2026-05-14 with Python 3.14 wheel coverage.
+
+torch>=2.12,<3.0
+
+# IMPORTANT: torchvision 0.27 declares requires_python "!=3.14.1,>=3.10" —
+# Python 3.14.1 specifically is excluded due to a known incompatibility.
+# The python-ci runner pulls python:3.14-bookworm (latest patch); if that
+# resolves to 3.14.1 the install will fail. Pin a specific Python patch in
+# the runner image (CI-Runner/CI-python/Dockerfile) if this becomes a
+# blocker. 3.14.0 and 3.14.2+ are fine.
+torchvision>=0.27,<0.28
+
+transformers>=5.8,<6.0
+onnxruntime>=1.26,<2.0
+huggingface-hub>=1.14,<2.0
+opencv-python-headless>=4.13,<5.0