chore: bump all dependencies to latest versions

[LukeMainwaring]

Routine dependency refresh via the updating-deps skill. Dependencies, lockfiles, and pinned library docs only — no source changes.

Summary

• Backend — 12 direct deps moved, headlined by pydantic-ai + pydantic-evals 2.0.0 → 2.11.0, torch 2.12.1 → 2.13.0, transformers 5.12.1 → 5.14.1, pgvector 0.4.2 → 0.5.0, braindecode 1.5.2 → 1.6.1.
• Frontend — 32 packages moved, including three majors: TypeScript 6.0.3 → 7.0.2, ai 6.0.191 → 7.0.29, @ai-sdk/react 3.0.193 → 4.0.32.
• Docs — refreshed docs/pydantic-ai-llms-full.txt and docs/vercel-ai-sdk-ui.txt.

Validation

All green, with no code changes required to absorb the upgrade:

• ruff + mypy --strict — pass
• pytest — 159/159 pass
• pnpm lint (ultracite/biome) — pass
• tsc --noEmit under TypeScript 7 — pass

Notes on the majors

• AI SDK v6 → v7 is wire-compatible. pydantic-ai's docs confirm v7's data-stream protocol equals v6's, so the backend SSE contract is intact. This is why the major landed without a runtime break.
• TypeScript 7 is the native Go port. tsconfig.json already conformed to every changed default (strict, module: esnext, types: [], moduleResolution).
• pnpm install emits a peer warning for ultracite → @typescript-eslint/utils (wants typescript <6.1.0). The upstream incompatibility is real, but inert here: ultracite lints via Biome and this repo has no ESLint config. Verified against the installed ultracite bundle.
• TS 7 dropped the language-service plugin API, so the next plugin (tsconfig.json:16-20) may stop providing IDE-only hints. Builds and CI unaffected; expected to return in TS 7.1.

Follow-ups (deliberately not included)

Tracked for a separate session; none are regressions from this bump:

1. Regenerate the API client — frontend/api/generated/core/params.gen.ts predates a prototype-pollution patch that both the old and new @hey-api/openapi-ts ship. Not currently exploitable (no call site passes attacker-controlled keys into buildClientParams), and the version bump alone doesn't fix it — regeneration does. Needs the backend running.
2. sdk_version=6 → 7 at routers/agent.py:89 and utils/message_serialization.py:21 — pydantic-ai 2.11.0 accepts Literal[5, 6, 7] and v7 is wire-identical to v6. Accuracy only.
3. experimental_throttle → throttle at components/chat.tsx:44 — deprecated alias, still functional.
4. Pre-commit ruff drift — .pre-commit-config.yaml:4 pins rev: v0.15.13 while pyproject.toml now floors at 0.15.22; the hook's isolated env runs the older ruff.

🤖 Generated with Claude Code