fix: constrain transitive setuptools to the patched release (#381)

#373 raised the build-system pin to setuptools>=83.0.0, but that only
governs building this package -- it does not constrain the resolved
environment. setuptools also arrives transitively (torch, pip-audit) with
no lower bound, so uv.lock stayed on 82.0.1 and the <83.0.0 advisory
remained open against the lockfile.

Add a uv constraint-dependencies entry so the transitive resolution is
pinned forward too, without introducing setuptools as a direct runtime
dependency.

Verified: uv sync --group dev --locked, ruff check, ruff format --check,
pytest (527 passing, 5 skipped), pip-audit clean.


Claude-Session: https://claude.ai/code/session_01GhbwK5NKaXutwKjqYzGjDk

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

Author: Abhash-Chakraborty

backend/pyproject.toml

@@ -101,6 +101,10 @@ torchvision = [
 ]
 
 [tool.uv]
+# setuptools arrives transitively (torch, pip-audit) and resolved to 82.0.1,
+# which is GHSA-affected (<83.0.0). The build-system pin above only governs
+# building this package, not the resolved environment, so constrain it here.
+constraint-dependencies = ["setuptools>=83.0.0"]
 conflicts = [
   [
     { extra = "cpu" },