security: pip-audit + bandit gates that can fail; patch 29 known CVEs

security.yml previously ran safety/bandit/semgrep with `|| true` and could
not go red. Now: pip-audit on requirements.txt is a hard gate (dev deps
reported only), bandit HIGH fails (B104 bind-all skipped: intended behind
Cloudflare/Caddy), pip-licenses uploaded as a report. Weekly + on
dependency/source changes.

Running it locally found 29 advisories, all in pinned-and-forgotten
runtime deps: starlette 0.27 (7, incl. Host-header path confusion and
form DoS), fastapi 0.104, requests 2.31 (3), pymysql 1.1. Bumped to
current: fastapi 0.141.1 / starlette 1.6.0, pydantic 2.13.5, uvicorn
0.52.4, requests 2.34.2, pymysql 1.2.0; dev: pytest 9.1.1, black 26.5.1.
pip-audit is now clean. requires-python narrowed to 3.11 (the truth:
psycopg2-binary 2.9.9 fails on 3.13; pandas 2.0.3 has no 3.12 wheels).
Full suite passes; API smoke-tested (health, stations, forecast, history,
stats, docs, openapi) on the new stack. black 26 reformatted 8 files.

src/postgres_history.py

@@ -51,8 +51,7 @@ class PostgresHistory:
         if start >= end:
             raise ValueError("start must be before end")
 
-        query = text(
-            """
+        query = text("""
             SELECT m.timestamp, s.station_code, m.water_level,
                    m.discharge, m.discharge_percent
             FROM water_measurements m
@@ -62,8 +61,7 @@ class PostgresHistory:
               AND m.timestamp <= :end_time
             ORDER BY m.timestamp ASC
             LIMIT :limit
-            """
-        )
+            """)
         with self.engine.connect() as connection:
             rows = connection.execute(
                 query,
@@ -91,9 +89,9 @@ class PostgresHistory:
                         "station_code": station_code,
                         "water_level": water_level,
                         "discharge": discharge,
-                        "discharge_percent": float(row[4])
-                        if row[4] is not None
-                        else None,
+                        "discharge_percent": (
+                            float(row[4]) if row[4] is not None else None
+                        ),
                     }
                 )
             return result