fix(deps): python-dotenv 1.2.2 (PYSEC-2026-2270, set_key symlink overwrite)

Now a direct dependency, pip-audit sees it; it used to come in through uvicorn. The .env parser is unchanged: rust/collector/testdata/gen_envfile_cases.py regenerates the 614-case fixture byte-identical under 1.2.2, so envfile.rs still matches.

requirements.txt

@@ -6,4 +6,4 @@ numpy>=1.24,<2  # pandas 2.0.3 wheels are ABI-incompatible with numpy 2.x
 scikit-learn==1.9.0
 sqlalchemy==2.0.23
 psycopg2-binary==2.9.9
-python-dotenv==1.1.1
+python-dotenv==1.2.2