chore(deps): bump dev and runtime dependencies

[NormallyGaussian]

Summary

Consolidates the 8 open Dependabot lockfile bumps (#78–#85) into one PR and pulls in additional available updates in the same pass. Held back:

• parallel-web — saved for a separate PR (0.4.2 → 0.5.1 wants its own review).
• pandas — kept on 2.x. The full upgrade pulled pandas 3.0.2 in for Python ≥ 3.11, which broke 4 tests in our duckdb/spark integrations (None vs nan handling). Worth doing as its own migration PR.

Notable bumps

• pytest 9.0.2 → 9.0.3
• requests 2.32.5 → 2.33.1
• cryptography 46.0.3 → 47.0.0
• pyopenssl 25.3.0 → 26.1.0
• pyasn1 0.6.2 → 0.6.3
• pygments 2.19.2 → 2.20.0
• python-dotenv 1.2.1 → 1.2.2
• tornado 6.5.4 → 6.5.5
• ruff 0.14.14 → 0.15.12
• ty 0.0.21 → 0.0.33
• rich 14.2.0 → 15.0.0
• pydantic 2.12.5 → 2.13.3
• duckdb 1.4.3 → 1.5.2
• polars 1.37.1 → 1.40.1
• snowflake-connector-python 4.2.0 → 4.4.0
• sqlalchemy 2.0.45 → 2.0.49
• google-cloud-bigquery 3.40.0 → 3.41.0
• pyarrow 23.0.0 → 24.0.0
• pyinstaller 6.18.0 → 6.20.0

The new ty 0.0.33 flagged a return-type mismatch in parse_inline_data (json.loads-derived dict values are inferred as object); the fix is a one-line annotation/cast in parallel_web_tools/cli/commands.py.

Closes #78, #79, #80, #81, #82, #83, #84, #85.

Test plan

• uv sync --all-extras
• uv run pytest — 602 passed
• uv run pre-commit run --all-files — ruff + ty pass
• parallel-cli --version smoke test