Patch 0.31.5: pin transitive security floors (tqdm, idna)

backend/requirements.txt carries only loose `>=` direct constraints and
no compiled lockfile, so osv-scanner v2 resolves the transitive graph and
pins each unpinned transitive package to its MINIMUM published version —
surfacing CVEs in ancient releases pip would never install. That fired a
phantom HIGH (tqdm 4.9.0, GHSA-r7q7-xcjw-qx8q) plus an idna finding on the
OHM Patchwatch radar, even though the live deployment runs patched versions.

Add `tqdm>=4.66.3` and `idna>=3.15` to anchor the resolver to the patched
range. osv-scanner now reports zero findings. No direct-import / schema /
API / config change; deployed installs already satisfy the floors.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/requirements.txt

@@ -9,3 +9,12 @@ google-generativeai>=0.8
 openai>=1.50
 PyYAML>=6.0
 bcrypt>=4.2
+
+# Security floors on unbounded *transitive* deps (not direct imports). osv-scanner
+# resolves an unpinned transitive package to its MINIMUM PyPI version, which surfaces
+# CVEs in ancient releases pip would never actually install. These floors keep the
+# Patchwatch radar (and any scan) anchored to the patched range.
+#   tqdm <- google-generativeai ; GHSA-r7q7-xcjw-qx8q et al., fixed in 4.66.3
+#   idna <- httpx / anthropic   ; GHSA-65pc-fj4g-8rjx,        fixed in 3.15
+tqdm>=4.66.3
+idna>=3.15