deps: resolve Dependabot security alerts

.github/dependabot.yml

@@ -30,22 +30,21 @@ updates:
       # websockets<16, so a bump to 16.x is unresolvable. Drop this once
       # langgraph-sdk widens its range.
       - dependency-name: "websockets"
-      # ccxt does not use ranges — it exact-pins (``==``) its entire transitive
-      # closure, and every one of the 23 packages below is currently held by it
-      # at precisely the version in our lock. None of them can move until ccxt
-      # itself releases, so a Dependabot PR touching any of them is unmergeable
-      # by construction: PR #882 proposed five of them and died with
-      # ResolutionImpossible. Verified by re-running the full resolver
-      # (`pip-compile --upgrade`, Python 3.11 on Linux) — it reproduces these
-      # exact versions, so this is the resolver's ceiling and not a stale lock.
+      # ccxt 4.5.71 still exact-pins most of its transitive closure, and every
+      # package below is held at precisely the version declared by ccxt. They
+      # cannot move independently, so a Dependabot PR touching any of them is
+      # unmergeable by construction: PR #882 proposed five and died with
+      # ResolutionImpossible. ccxt 4.5.71 switched requests, cryptography,
+      # aiohttp, and yarl to compatible ranges and stopped declaring setuptools;
+      # those packages are intentionally no longer ignored so security updates
+      # can move them without waiting for another ccxt release.
       #
       # This suppresses only the automated PRs. Dependabot *alerts* come from
       # the dependency graph and are unaffected by this file, so a CVE in
-      # cryptography/urllib3/requests/certifi still surfaces in the Security
-      # tab — the remedy there is to bump ccxt, which carries the whole set.
+      # an exact-pinned package below still surfaces in the Security tab; the
+      # remedy there is to bump ccxt, which carries the pinned version.
       # Drop an entry here if ccxt ever loosens that pin.
       - dependency-name: "aiohappyeyeballs"
-      - dependency-name: "aiohttp"
       - dependency-name: "aiohttp-fast-zlib"
       - dependency-name: "aiosignal"
       - dependency-name: "attrs"
@@ -53,19 +52,15 @@ updates:
       - dependency-name: "cffi"
       - dependency-name: "charset-normalizer"
       - dependency-name: "coincurve"
-      - dependency-name: "cryptography"
       - dependency-name: "frozenlist"
       - dependency-name: "idna"
       - dependency-name: "multidict"
       - dependency-name: "orjson"
       - dependency-name: "propcache"
       - dependency-name: "pycparser"
-      - dependency-name: "requests"
-      - dependency-name: "setuptools"
       - dependency-name: "typing-extensions"
       - dependency-name: "urllib3"
       - dependency-name: "uvloop"
-      - dependency-name: "yarl"
       - dependency-name: "zlib-ng"
       # pydantic-core is exact-pinned by pydantic (``pydantic-core==2.46.4``),
       # so it only ever moves as part of a pydantic release. It was the sixth