chore: tier 2 python dep upgrades — medium-risk majors (#848)

Drops the protective upper-bound pins added in #844 for the medium-risk major bumps. All 6 majors verified to work with the existing code via a fresh container boot + smoke tests against the specific code paths each library is used in. Bumped (top-level + selected transitives): aiofiles 23.2.1 → 25.1.0 bcrypt 4.3.0 → 5.0.0 cryptography 41.0.7 → 46.0.7 environs 9.5.0 → 15.0.1 grafana-client 3.11.2 → 5.1.0 xmltodict 0.15.1 → 1.0.4 Compat pin lifted (was required for environs 9 + marshmallow 4 incompatibility): marshmallow 3.26.2 → 4.3.0 (no longer pinned <4) Smoke tests (run inside the rebuilt backend container) confirm: - bcrypt 5.0.0: hashpw + checkpw round-trip OK (used by app/auth/models/users.py:Password.generate()) - cryptography 46.0.7: Fernet encrypt/decrypt round-trip OK (used by app/auth/services/totp.py for encrypted TOTP secrets) - environs 15.0.1: Env().bool() / Env().str() / Env().read_env() OK (used by app/db/db_session.py + app/data_store/data_store_session.py) - grafana-client 5.1.0: all 5 API paths the code uses still exist: admin.create_user, admin.delete_user, organizations.organization_user_add, user.switch_actual_user_organisation, dashboard.update_dashboard - aiofiles 25.1.0: async open() / read() OK - xmltodict 1.0.4: parse/unparse round-trip OK (used by app/connectors/wazuh_manager/services/rules.py) Verified at boot: - docker build of backend/Dockerfile succeeds - all ~50 routers import without ModuleNotFoundError - alembic upgrade head runs, all seed funcs complete, "Application startup complete" + "Scheduler started" in logs - existing MySQL test data unchanged across the rebuild - GET / returns HTTP 200 Note on grafana-client 5.1.0: import emits a SyntaxWarning from elements/datasource.py:414 and elements/_async/datasource.py:420 (`timestamp=["data"]["to"]` is a typo — should be `timestamp=request["data"]["to"]`). The bug is upstream, only fires on the Prometheus instant-query proxy path, and CoPilot does not use that path. Worth filing upstream but doesn't block this PR. Roadmap state after this PR: - Tier 1, Tier 2 done - Remaining majors: pydantic 1→2 (29 @validator + 44 class Config sites), SQLAlchemy 1.4→2.0 (142 AsyncSession sites). Each a dedicated migration PR. Co-authored-by: taylor_socfortress <taylor.walton@socfortress.co> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>