chore(deps): resolve Dependabot security alerts

[mplatzer]

Summary

Resolves all open Dependabot security alerts across dependencies in pyproject.toml and uv.lock.

Upgraded Packages

Package	Open Alerts	Previous Version	Patched Version
vllm	12	0.20.0	0.28.0
pillow	13	12.2.0	12.3.0
aiohttp	14	3.13.5	3.14.3
pyjwt	5	2.12.1	2.13.0
starlette	5	0.52.1	1.6.0
cryptography	4	47.0.0	50.0.1
tornado	4	6.5.5	6.5.8
python-multipart	4	0.0.27	0.0.32
pymdown-extensions	3	10.21	11.0.2
mcp	3	1.27.0	2.1.1
torch	2	2.11.0	2.13.0
setuptools	2	80.10.2	84.0.0
soupsieve	2	2.8.3	2.9.2
urllib3	2	2.6.3	2.7.0
json-repair	1	0.58.1	0.63.4
pydantic-settings	1	2.13.1	2.15.0
idna	1	3.11	3.19
diskcache	1	5.6.3	Removed

Changes

• Updated pyproject.toml dependency bounds (torch>=2.13.0,<2.14.0, torchvision>=0.28.0,<0.29.0, xgrammar>=0.2.1,<1.0.0, transformers>=5.5.3, json-repair>=0.60.1, pymdown-extensions>=11.0, vllm==0.28.0; sys_platform == 'linux').
• Removed direct setuptools runtime dependency constraint in pyproject.toml.
• Updated .github/workflows/run-tests-cpu.yaml with PyTorch 2.13.0+cpu and Torchvision 0.28.0+cpu wheels.
• Updated uv.lock.

Verification

• uv run pre-commit run --all-files passed.
• uv run mkdocs build --strict passed.
• All unit and end-to-end tests passed.