fix(deps): Patchwatch security floors for tqdm/idna/vitest (v0.55.1)

Clears Patchwatch advisories #36–#40 on the OHM deployment (affecting
ohm-rfc-app + rfc-app-ppe) by forcing the vulnerable dependencies to
patched versions:

- backend/requirements.txt: floor-pin tqdm>=4.66.3 (#37/#39/#40, resolves
  4.68.2) and idna>=3.15 (#38, resolves 3.18) — both arrive transitively
  with no lockfile, so a floor-pin is the robust fix.
- frontend/package.json: vitest ^3.0.0 -> ^4.1.0 (#36, resolves 4.1.8;
  dev/test-only, GHSA-5xrq-8626-4rwp UI-server file read/exec). Lockfile
  regenerated.

No behavior change; backend (685), frontend (66), and localhost E2E (5)
suites pass. Issues are closed after the change is deployed and re-scanned,
not on merge. Patchwatch Phase 2 remediation, session ohm/0095.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/requirements.txt

@@ -9,3 +9,11 @@ google-generativeai>=0.8
 openai>=1.50
 PyYAML>=6.0
 bcrypt>=4.2
+
+# Transitive-dependency security floors (Patchwatch #37/#38/#39/#40).
+# tqdm and idna arrive transitively; these floor-pins force resolution to
+# the patched versions so the deployed environment clears the advisories.
+# tqdm>=4.66.3 covers GHSA-r7q7-xcjw-qx8q, GHSA-g7vv-2v7x-gj9p, PYSEC-2017-74.
+# idna>=3.15 covers GHSA-65pc-fj4g-8rjx (CVE-2024-3651 bypass).
+tqdm>=4.66.3
+idna>=3.15