chore(deps): consolidate Python dependency upgrades (May 2026)

[mekarpeles]

Summary

Consolidates open Renovate PRs into a single tested upgrade. All packages installed and verified in Docker before opening this PR.

Packages upgraded

Package	Before	After	Severity	Closes
pydantic	2.13.3	2.13.4	Low — patch bump	#12619
aiofiles	23.2.1	25.1.0	Low — major bump (async API unchanged)	#12676
requests	2.33.1	2.34.0	Low — minor bump	#12759
python-multipart	0.0.27	0.0.28	Low — patch bump	#12759

Excluded packages

Package	Reason
luqum 0.11.0 → 0.14.0 (#12759)	Breaking: luqum 0.14.0 changed query parenthesization — title:foo AND bar AND by:boo blah blah no longer groups trailing words as by:(boo blah blah). Confirmed via Docker test: test_luqum_parser fails. Needs separate investigation/fix.
Python 3.14.5 (#12643)	Python 3.14 introduces stricter string literal parsing; openlibrary/templates/type/tag/index.html:30 fails with "unterminated string literal". Needs separate investigation.
chart.js 2.9.4 → 4.5.1 (#12761)	2-major-version jump; likely breaking API changes. Needs its own PR.
babel-loader 9 → 10 (#12760)	Major version bump; needs separate PR.
@eslint/js 9 → 10 (#12675)	Major version bump; needs separate PR.

Testing

• ✅ All 4 packages install cleanly in Docker
• ✅ Versions verified in web container
• ✅ make test: 3809 passed, 0 failed
• ✅ HTTP 200 smoke test
• ✅ pre-commit clean
• ✅ luqum 0.14.0 regression confirmed and excluded (Docker test shows test_luqum_parser failure)

[Copilot]

Copilot wasn't able to review any files in this pull request.