chore(deps): bump anyio and soupsieve for five new CVEs

[wongk]

Why

The CI dependency audit now fails on every PR. Five advisories were published after main's last green run:

package	locked	CVEs	fixed in
anyio	4.14.1	CVE-2026-63374, CVE-2026-64847, CVE-2026-63349	4.14.2
soupsieve	2.8.4	CVE-2026-85999, CVE-2026-86000	2.9

Change

uv.lock only: 12 lines, the version, sdist and wheel entries of those two packages. The new releases declare exactly the same requirements as the old ones (checked against PyPI metadata), so no other package moves.

Checks run:

• uv lock --check resolves 434 packages, the same as before.
• uv sync --frozen --group dev installs both with their hashes verified.
• The CI audit command (uv export … | pip-audit with the existing ignores) reports no known vulnerabilities.
• Every test file that touches anyio, asyncio, bs4 or web_fetch passes.

Why the lockfile was edited instead of running uv lock --upgrade-package

With uv 0.12.2, uv lock --upgrade-package <any package> re-resolves the whole lock and drops 114 packages. That is about 1,900 lines, mostly the dependency tree of the memory-server extra, which conflicts with langfuse. This happens even for soupsieve alone.

A plain uv lock and uv lock --check are both no-ops, so the committed lock is consistent. The next dependency bump that re-resolves should expect this and check that the memory-server fork survives.