chore(deps): bump to latest verified set, drop py3.9, prune unused deps

[jstzwj]

Summary

Refreshes the dependency set, closing the gap left by the five stale Dependabot PRs (#23, #27, #28, #29, #30 — all closed as already-satisfied).

Version bumps (all verified against the full offline test suite)

Package	Old	New
fastapi	0.115.2	0.141.1
httpx	0.27.0	0.28.1
pydantic	2.8.2	2.13.4 (upper bound <=2.8.2 lifted)
pydantic-settings	2.4.0	2.15.0 (upper bound <=2.4.0 lifted)
huggingface_hub	0.26.0	1.27.0 (major; huggingface_hub.constants imports intact)
fastapi-utils	0.7.0	0.8.0
pytest	8.3.3	9.1.1
tenacity	8.5.0	9.1.4
portalocker	3.1.1	4.1.0
peewee	3.17.6	3.19.0 (stays on 3.x; 4.x is a rewrite)
GitPython / PyYAML / jinja2 / python-multipart		latest

Dependency hygiene

• Removed cachetools, aiofiles, numpy — zero references anywhere in src/ + tests/.
• Added brotli (used by zip_utils, was missing from requirements.txt), peewee (used by olah.database, was missing from pyproject), pytest-asyncio (used by tests, listed nowhere).

Python floor: 3.9 → 3.10

The new core versions (fastapi 0.141, huggingface_hub 1.x, pytest 9, tenacity 9, portalocker 4, pydantic-settings 2.15) all require Python ≥3.10; 3.9 went EOL Oct 2025. Docker images / conda env / release workflow already use 3.12, so the only change is requires-python and the CI matrix (now 3.10–3.13).

Drive-by fix

database/models.py called db.connect() at import time without creating ~/.olah, so importing the module on a fresh machine crashed with peewee.OperationalError: unable to open database file. Now the parent dir is created first.

Testing

• Full offline suite on two fresh venvs with the new pinned set: 130 passed. The single failure is the pre-existing unrelated test_server_layers one, which fails identically on the old dependency set.
• Import smoke: server / proxy / cache / database modules + huggingface_hub.constants all import cleanly on hf_hub 1.27.
• pip install -e . + pip install -r requirements.txt resolve cleanly from scratch.