fix(deps): update vulnerable Click, MCP, and pypdf pins - #5526

Summary\n\n- bump Click from 8.3.1 to 8.3.3, the fixed release for PYSEC-2026-2132\n- bump MCP from 1.26.0 to 1.28.1, the common fixed floor for PYSEC-2026-3481, PYSEC-2026-3482, and PYSEC-2026-3483\n- bump pypdf from 6.14.2 to 6.15.0, the fixed release for PYSEC-2026-3655 and PYSEC-2026-3656\n- keep the change limited to the three exact runtime pins\n\n## Why\n\nThe current exact pins prevent downstream resolvers from selecting patched releases. Updating to the minimum common fixed versions clears the complete advisory set without unrelated dependency churn.\n\n## Validation\n\n- uv lock --dry-run --python 3.11 (resolved the full 400-package graph)\n- pre-commit run --files pyproject.toml --show-diff-on-failure\n- uv build --wheel\n- verified the built wheel metadata contains click==8.3.3, mcp==1.28.1, and pypdf==6.15.0\n\nNo UI changes; a screenshot is not applicable.\n\nFixes #5524

Summary by cubic

Updates exact runtime pins for click, mcp, and pypdf to patched versions to remove known vulnerabilities and let downstream resolvers select fixed releases.

• click: 8.3.1 → 8.3.3 (fixes PYSEC-2026-2132).
• mcp: 1.26.0 → 1.28.1 (fixes PYSEC-2026-3481/3482/3483).
• pypdf: 6.14.2 → 6.15.0 (fixes PYSEC-2026-3655/3656).
• Change is limited to these three pins; no functional or API changes.
• Validation: uv lock --dry-run --python 3.11, pre-commit on pyproject.toml, wheel build; wheel metadata shows the new pins.

^{Written for commit c25fea2. Summary will update on new commits.}