Upgrade every dependency to its latest release, anthropic 2.x included - #18

Every locked package in every project moves to its newest release, and
every declared floor moves with it, runtime and tooling alike; all 80
locked packages now sit at the latest version on PyPI. setup-uv goes to
v10.3.3, a tag resolved against the remote; actions/checkout@v7 already
points at v7.0.1, the newest release. This covers everything in the
open Dependabot pull requests (#11 mcp 2.3.0, #12 setup-uv 10.3.0, and
the routine group in #17, which replaced #15), at or past each version
they propose, so it replaces them.

The one major is anthropic, 1.9.0 to 2.3.0, in chatbot and mcp. 2.0.0
is the first release that sends API version 2026-10-21 instead of
2023-06-01, so both projects move to the new version, following the
API's migration guide (platform.claude.com/docs/en/api/migration-2026-10-21):

- 2026-10-21 rejects a Messages request carrying temperature, top_p or
  top_k with a 400, even at the default. mcp's Claude.chat() sent
  temperature=1.0 on every request, so every chat turn would have
  failed; the field and the parameter are gone (nothing passed it). A
  new test asserts no sampling parameter goes out, and it fails with
  temperature put back.
- MessageParam is now a union with one TypedDict per role. Annotations
  keep working; cli_chat built its dicts from a role variable, which
  matches none of them, so each role now gets its own literal.
- The key now travels as Authorization: Bearer, and a client holds one
  credential. Neither project sets a base URL, a proxy, X-Api-Key or a
  second credential, so nothing else changes. chatbot needed no code
  change at all. The SDK is Apache 2.0 from 2.0.0 (MIT before).

lemon's MySQL healthcheck now pings over TCP. CI's lemon job failed
with every test erroring on MySQL error 2013, "Lost connection to MySQL
server at 'reading initial communication packet'"; the race predates
this change. On an empty volume, which is every CI run, the mysql image
first runs a temporary server with networking off while it creates the
database, then restarts as the real server on TCP 3306. The healthcheck
pinged `-h localhost`, which mysqladmin takes to mean the Unix socket,
so it could pass against the temporary server, and `docker compose up
--wait` returned before anything listened on 3306. Reproduced on fresh
volumes: healthy while the log showed only "Temporary server started",
a TCP connection closed without a server greeting, and the suite run
right after `--wait` gave 16 errors in 3 of 3 runs. Pinging with
`-h 127.0.0.1 --protocol=tcp` cannot reach the temporary server:
`--wait` now holds about 11 seconds, and the suite passed in 5 of 5
fresh-volume runs; an existing volume still works, its data kept.

All 141 tests pass across the four projects, lemon's against MySQL from
its compose file, and lint is clean on ruff 0.17.3. Both the PyPI
vulnerability feed and the full GitHub-reviewed advisory database
report nothing for any locked version. The tests replace the SDK call,
so both projects also ran through the real anthropic 2.3.0 client with
only the HTTP transport mocked: requests carry anthropic-version
2026-10-21 and a bearer key, with no X-Api-Key and no sampling field;
chatbot's complete() returned a reply and a refusal and mapped 401,
403, 404, 429, 500 and a connection failure as before; and mcp's chat
loop, never run end to end before, went question, tool_use, a real
read from the document server over stdio, tool_result, answer, plus a
/format prompt. Past that, chatbot served its page and assets under
uvicorn and answered over the WebSocket; lemon's browsable-API markdown
rendered through markdown 3.11.2; and djoser's social views and
simplejwt behaved as before, the single-use-state limitation recorded
beside the djoser dependency included.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PJbZcrXFYA1x2ppHdCG5uT