fix(security): remediate Trivy CRITICAL vulnerabilities

[Kaiohz]

Summary

• crawl4ai 0.7.4 -> 0.8.0: fixes CVE-2026-26216 (RCE via Docker API hooks) and CVE-2026-26217 (LFI via file:// URLs)
• langchain-core 0.3.70 -> 0.3.81: fixes CVE-2025-68664 (arbitrary code execution via serialization injection)
• nltk 3.9.1 -> 3.9.3 (transitive): fixes CVE-2025-14009 (Zip Slip vulnerability leading to code execution)

Bonus fixes pulled in transitively:

• cryptography 45.0.6 -> 46.0.0
• pyopenssl 25.1.0 -> 26.0.0

Remaining HIGH vulnerabilities (not addressed in this PR)

Library	CVE	Installed	Fixed	Title
aiohttp	CVE-2025-69223	3.12.14	3.13.3	Zip bomb via auto_decompress
brotli	CVE-2025-6176	1.1.0	1.2.0	Decompression bomb DoS
langchain-text-splitters	CVE-2025-6985	0.3.8	0.3.9	XXE vulnerability
langgraph-checkpoint	CVE-2025-64439	2.1.1	3.0.0	RCE in JsonPlusSerializer
mcp	CVE-2025-66416	1.10.1	1.23.0	DNS rebinding protection disabled
orjson	CVE-2025-67221	3.11.0	3.11.6	DoS via unbounded recursion
pillow	CVE-2026-25990	11.3.0	12.1.1	OOB write via crafted PSD
protobuf	CVE-2026-0994	6.31.1	6.33.5	DoS via recursion depth bypass
pyasn1	CVE-2026-23490, CVE-2026-30922	0.6.1	0.6.3	DoS via memory exhaustion / unbounded recursion
python-multipart	CVE-2026-24486	0.0.20	0.0.22	Arbitrary file write via path traversal
starlette	CVE-2025-62727	0.46.2	0.49.1	DoS via Range header merging
urllib3	CVE-2025-66418, CVE-2025-66471, CVE-2026-21441	2.5.0	2.6.3	Decompression chain / streaming API / redirect bypass

Test plan

• poetry run pytest passes (281 passed, 1 pre-existing failure, 6 pre-existing env config errors)
• Trivy re-scan confirms 0 CRITICAL vulnerabilities remaining
• Rebuild Docker images and verify application starts correctly
• Smoke test MCP endpoints and crawl4ai web scraping functionality

[Kaiohz]

Closing: the security fixes from this PR (langchain-core >= 0.3.81) are already on main. Crawl4AI has been removed from the project. No remaining diff after rebase.