v0.4.1 — release pipeline fix

Patch release fixing the release/publish pipeline.

• Cap fastapi>=0.115,<0.136: FastAPI 0.136 changed include_router to keep nested router objects instead of flattening routes onto app.routes, which emptied the OpenAPI schema of the /v1 and studio routes (routing still worked, but schema + client generation broke). Pinning restores the working inclusion model for all installs.
• Wheel-test CI job installs testcontainers[postgres] so the Docker-gated backend tests run.

Includes all v0.4 security hardening (econ token-issuer block, ECP_JWT_SECRET fail-closed guard, studio/cost RBAC, budget fail-open logging).