chore(deps): batch Dependabot security updates

[nadaverell]

Summary

• update Flask, Flask-Cors, itsdangerous, and Werkzeug to patched releases
• regenerate Pipfile.lock from the updated pins

Testing

• pipenv verify
• pipenv sync and dependency import smoke test under local Python 3.14
• python -m unittest discover
• Flask test-client route smoke test

Note: the template declares Python 3.10; Python 3.10 is not installed on this machine, so CI remains the authoritative check for that runtime.

---

Note

Medium Risk
Flask 2→3 is a major bump on the HTTP app layer; risk is moderated by patch-focused pins and described smoke/unit tests, but runtime behavior should be validated on Python 3.10 in CI.

Overview
Bumps pinned web stack dependencies for security patches across Pipfile, requirements.txt, and a regenerated Pipfile.lock.

Flask moves from 2.2.5 to 3.1.3 (major version). Flask-Cors, itsdangerous, and Werkzeug are also raised to patched releases (including aligning requirements.txt Werkzeug to 3.1.8). The lockfile picks up related transitive updates (e.g. blinker, typing-extensions, prometheus-client).

^{Reviewed by Cursor Bugbot for commit 0252a05. Bugbot is set up for automated code reviews on this repo. Configure here.}