fix: update Python dependencies for security

[bitkarrot]

Summary

• Updates lnbits to 1.6.0rc2 (pulls in newer transitive deps)
• Adds explicit constraints: Pillow>=12.3.0, aiohttp>=3.14.3, cryptography>=50.0.0, protobuf>=6.33.5
• Resolves most of the 59 Dependabot security alerts (Pillow, aiohttp, cryptography, protobuf, python-multipart)

Remaining (blocked by upstream)

• starlette — lnbits pins >=0.47.1,<0.49.0, but fix requires >=1.3.1
• pyjwt — lnbits pins >=2.12.0,<2.13.0, but fix requires >=2.13.0
• These need to be fixed upstream in lnbits before they can be resolved here

Test plan

• poetry lock resolves successfully
• Vulnerable package versions confirmed in lock file