chore(test): upgrade pytest 8→9 for GHSA-6w46-j5rx-g56g

[haksungjang]

What

The last remaining actionable Dependabot alert from the dependency sweep: pytest's tmpdir advisory (GHSA-6w46-j5rx-g56g), fixed in 9.0.3. It was deferred out of PR #476 because the fix is a major bump that could break the test suite — this PR carries it on its own so any breakage is isolated.

Moving to pytest 9 pulls two compatible majors (pip-resolved):

pytest         8.3.4  -> 9.0.3
pytest-asyncio 0.24.0 -> 1.4.0
pytest-cov     6.0.0  -> 7.1.0

Plus asyncio_default_fixture_loop_scope = "function" in pyproject.toml: pytest-asyncio 1.x makes the async-fixture loop scope configurable and warns when unset. function preserves the per-test loop behaviour the suite already ran under with 0.24 (the root _isolate_engine_per_test autouse fixture is function-scoped), so the upgrade is behaviour-preserving.

Verification

• Clean pip resolution of the three-package set.
• asyncio_mode = "auto" still auto-collects async tests and --cov still reports under 9.0.3 / 1.4.0 / 7.1.0 (minimal repro).
• The suite has no event_loop fixture override (removed in asyncio 1.x), no module/session-scoped async fixtures, and no warnings-as-errors config — the three things that most often break this upgrade.
• The full DB-backed suite is validated by CI test (backend); this PR should not be merged unless that job is green.

Result

Clears the pytest advisory. After merge, the only remaining open Dependabot alert is weasyprint (no upstream patch available — kept open as a tracker).