chore(deps): update dependencies and bump ruff to 0.16.10

[monodo]

Summary

Refreshed the uv lockfile to the latest compatible releases, aligned the declared version bounds, and bumped the uv base image used in both Dockerfiles.

Notable direct dependency bumps:

• fastapi 0.141.1 -> 0.142.2
• uvicorn 0.52.4 -> 0.54.0
• ruff 0.16.4 -> 0.16.10 (dev)

Notable transitive bumps: starlette 1.3.1 -> 1.7.0, pydantic 2.13.4 -> 2.13.5, lxml 6.1.1 -> 6.1.3, coverage 7.14.3 -> 7.16.2, urllib3 2.7.0 -> 2.8.0, anyio 4.14.0 -> 4.15.1, wrapt 2.2.2 -> 2.5.0, deprecated 1.3.1 -> 3.0.0. opentelemetry-api is pulled in as a new transitive dependency of deprecated 3.x.

Also bumped the ruff-pre-commit rev from v0.14.14 to v0.16.10 so pre-commit matches the version pinned in pyproject.toml, and bumped the ghcr.io/astral-sh/uv base image from 0.12.3 to 0.12.23 in Dockerfile and Dockerfile.lambda.

This supersedes and replaces #235 and #233 (both closed), which only covered a subset of these bumps.

Security

This clears all 4 Dependabot alerts that were open on main:

• anyio (1 critical, 1 high, 1 moderate) - requires >= 4.14.2, lockfile now pins 4.15.1
• urllib3 (1 moderate) - requires >= 2.8.0, lockfile now pins 2.8.0

Testing

• uv run ruff check . - all checks passed
• uv run ruff format --check . - 30 files already formatted
• uv run python -m pytest -v --cov=drillapi - 43 passed, 94% coverage
• docker build -f Dockerfile . and docker build -f Dockerfile.lambda . both build successfully with the bumped uv image

No source changes were needed.

Known pre-existing CI issues (not introduced by this PR)

• Security Scan workflow fails at startup: it still references ecr-build-scan-push.yml@v9 while publish-ecr.yml moved to @v12. Pre-existing version drift, unrelated to this change.
• Build-push-scan Inspector check reports 10 high findings in the Lambda base image (public.ecr.aws/lambda/python:3.14), mainly libxml2 CVEs. AWS has not yet published the patched RPM (dnf upgrade still reports Nothing to do); confirmed with a local build.

Follow-up

Starlette 1.7.0 emits a new deprecation warning: using httpx with starlette.testclient is deprecated in favour of httpx2. Tests still pass, but migrating the test client dependency is worth a separate PR once respx supports httpx2.