fix(deps): python-dotenv 1.2.2 (PYSEC-2026-2270, set_key symlink overwrite)

Now a direct dependency, pip-audit sees it; it used to come in through uvicorn. The .env parser is unchanged: rust/collector/testdata/gen_envfile_cases.py regenerates the 614-case fixture byte-identical under 1.2.2, so envfile.rs still matches.

rust/collector/src/envfile.rs

@@ -1,4 +1,5 @@
-//! `.env` loading with python-dotenv 1.1.1 semantics (`load_dotenv()`:
+//! `.env` loading with python-dotenv semantics (1.1.1 and 1.2.2 parse the
+//! fixture identically; `load_dotenv()`:
 //! interpolate `${VAR}` / `${VAR:-default}`, never override variables that
 //! are already set).
 //!