fix: resolve open security alerts (pygments, pip, base image CVEs)

[BKDDFS]

Summary

Resolves the 4 open security alerts in the repo. No secrets leaked; most prior alerts already fixed via dependabot history.

Alert	Issue	Fix	Status
Dependabot #56	Pygments ReDoS (GUID regex)	override pygments>=2.20.0	fully fixed
Code scan #1869	pip 25.3 path traversal (CVE-2026-1703)	uninstall unused base-image pip	fully fixed
Code scan #1958	gnutls DoS (CVE-2025-14831)	apt-get upgrade	best-effort*
Code scan #1868	libxml2 leak (CVE-2026-1757)	apt-get upgrade	best-effort*

* No upstream Debian fix yet (Fixed Version: empty). apt-get upgrade clears these once Debian ships patched packages.

Changes

• pyproject.toml / uv.lock — [tool.uv] override-dependencies forcing pygments>=2.20.0. Kept out of prod deps (transitive via pytest, test-only). Re-locked: 2.19.2 → 2.20.0.
• Dockerfile — apt-get upgrade -y for latest Debian security patches; pip uninstall -y pip to remove the base image's unused pip 25.3 (uv manages the venv, runtime never invokes pip).

Verification

• uv lock --locked consistent.
• Docker build succeeds; confirmed in image: pip absent from site-packages, import perfectframe.app OK.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.