chore(test): upgrade pytest 8→9 for GHSA-6w46-j5rx-g56g

apps/backend/pyproject.toml

@@ -1,5 +1,11 @@
 [tool.pytest.ini_options]
 asyncio_mode = "auto"
+# Pin the async-fixture event-loop scope explicitly. pytest-asyncio 1.x makes
+# this configurable and warns when it is unset; "function" preserves the
+# per-test loop behaviour the suite ran under with pytest-asyncio 0.24 (the
+# root `_isolate_engine_per_test` autouse fixture is function-scoped), so the
+# 8->9 upgrade is behaviour-preserving.
+asyncio_default_fixture_loop_scope = "function"
 testpaths = ["tests"]
 pythonpath = ["."]
 markers = [

apps/backend/requirements-dev.txt

@@ -1,7 +1,7 @@
 -r requirements.txt
-pytest==8.3.4
-pytest-asyncio==0.24.0
-pytest-cov==6.0.0
+pytest==9.0.3
+pytest-asyncio==1.4.0
+pytest-cov==7.1.0
 ruff==0.8.4
 mypy==1.13.0
 # Phase 2 PR #8: in-memory Redis double for CircuitBreaker unit tests.