Pin backend-api dependencies to exact versions

[listlessbird]

Motivation

• Make backend installs deterministic and auditable by replacing open-ended dependency ranges with exact versions.
• Reduce risk from unexpected transitive upgrades and simplify vulnerability review for the backend API dependencies.

Description

• Replaced ranged specifiers (e.g., >=) with exact == pins for runtime dependencies in backend-api/pyproject.toml, including packages such as fastapi, uvicorn, transformers, pydantic, numpy, and boto3.
• Pinned development dependencies in backend-api/pyproject.toml, including ipykernel, pandas, ruff, and types-boto3-custom to match the vendored wheel.
• Regenerated backend-api/uv.lock so lock metadata reflects the new exact specifiers.
• Recorded the change and created a PR for review.

Testing

• Ran cd backend-api && uv lock --check, which failed initially because pyproject.toml changed and the lockfile needed refresh.
• Ran cd backend-api && uv lock to refresh the lockfile, which completed successfully.
• Reran cd backend-api && uv lock --check, which completed successfully and validated the updated lockfile.

---

Codex Task

[listlessbird]

in the light of recent litellm package compromise