fix(deps): python-dotenv 1.2.2 (PYSEC-2026-2270, set_key symlink overwrite)

Now a direct dependency, pip-audit sees it; it used to come in through uvicorn. The .env parser is unchanged: rust/collector/testdata/gen_envfile_cases.py regenerates the 614-case fixture byte-identical under 1.2.2, so envfile.rs still matches.

pyproject.toml

@@ -36,8 +36,9 @@ dependencies = [
     "scikit-learn==1.9.0",
     "sqlalchemy==2.0.23",
     "psycopg2-binary==2.9.9",
-    # .env loading; rust/collector/src/envfile.rs ports exactly this version
-    "python-dotenv==1.1.1",
+    # .env loading; rust/collector/src/envfile.rs ports its parser (the 614-case
+    # fixture is identical for 1.1.1 and 1.2.2; regenerate it when bumping)
+    "python-dotenv==1.2.2",
 ]
 
 [project.urls]