Security: upgrade Python deps and align DB migrations (Dependabot fixes)

[Raphux]

Updates Python dependencies to latest stable compatible versions to address multiple Dependabot alerts and keep the stack coherent with Flask 3.x:

• Werkzeug 3.1.5 (alerts Adding plain text return on passhportd for users management #31, Unique email when filled, but allow multiple users with void email. W… #38, removing database which has no place on git #39, Code duplication on compatibility #49, Remove useless files from the repository #53, Add a system to deploy the server public key on a new target  #21, Bump werkzeug from 2.2.3 to 3.0.6 #657)
• Flask 3.1.2 (alert Passhport client is not plugged to server #9)
• Jinja2 3.1.6 (alerts Check the pattern email #44, Reorganisation of managing users and fixing some small issues #41, Adding the possibility to add a user from the ocmmand line interface #42)
• urllib3 2.6.3 (alerts Code line limit should be respected #50, Check style #51, replace tar_prompt by target_prompt #52, “Pythonic” way to test if a string is empty #46)
• requests 2.32.5 (alert Complete all the requests in client-side for the user functions + fixing the issue #8 #45)
• setuptools 80.9.0 (alerts No more 404 HTTP Error #54, Implementation of basic functions for all modules #55)
• sqlparse 0.5.5 (alert Directories reorganization  #30/Bump sqlparse from 0.4.4 to 0.5.0 #642)
• idna 3.11 (alert Typo + crappy tests on Requests #29/Bump idna from 3.3 to 3.7 #644)
• zipp 3.23.0 (alert Integrity error on email when creating a new user #36/Bump zipp from 3.8.1 to 3.19.1 #652)
• certifi 2026.1.4 (alert Encodage error when using non-ascii characters in the email field when creating user #43)
• alembic 1.15.2 to satisfy Flask-Migrate 4.1.0
• Flask-SQLAlchemy 3.1.1, Flask-Migrate 4.1.0
• remove python-ecdsa (alert Inconsistence in URL for editing #48) since unused in code

Switches db initialization from sqlalchemy-migrate to Alembic/Flask-Migrate:

• db_create.py now creates tables and stamps head in app context
• env.py avoids duplicate compare_type argument with new Flask-Migrate
• update-passhport.sh no longer installs sqlalchemy-migrate

Fixes user deletion for names containing '@' by decoding the route param before DB lookup.

Note: Bootbox XSS alert #22 is not addressed in this commit.

Refs: #31 #38 #39 #49 #53 #21 #657 #9 #44 #41 #42 #50 #51 #52 #46 #45
#54 #55 #30 #642 #29 #644 #36 #652 #43 #48