Fix CI: pin Flask 1.1.2 transitive deps and suppress noqa E402 in test imports

[Copilot]

The "Python application" CI workflow was failing on two fronts after adding tests/test_app.py, which imports app.py directly (triggering full Flask initialization at collection time).

Summary

What changed:

• requirements.txt: pin three transitive dependencies that Flask 1.1.2 is incompatible with at their latest versions:
  • Jinja2>=2.10.1,<3.0.0 — Jinja2 3.0 removed escape, imported at module level by Flask 1.1.2
  • itsdangerous>=0.24,<2.0 — itsdangerous 2.0 removed the json submodule used by flask/json/__init__.py
  • MarkupSafe>=1.1.1,<2.1.0 — MarkupSafe 2.1 removed soft_str, required by Jinja2 2.x
• tests/test_app.py: add # noqa: E402 to the three from app import … lines that legitimately follow sys.path.insert()

Why:
CI was resolving Jinja2→3.1.6, itsdangerous→2.2.0, MarkupSafe→3.0.3 (all unbound in requirements.txt), causing pytest collection to abort with ImportError: cannot import name 'escape' from 'jinja2'. The E402 warnings were surfacing because flake8 flags imports after any executable statement.

Validation

• Local checks passed (make test)
• Runtime check done where relevant (make health)
• CI checks are green

AI-Assisted Review (if applicable)

• I used AI assistance for parts of this change
• I manually reviewed all AI-generated code
• I verified no secrets/credentials were added

Risk & Rollback

• Risk level: Low
• Rollback plan: revert the three version pins in requirements.txt and remove # noqa comments (CI will regress to the same import failure).

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.