fix: update idna lockfile dependency

[cesarenaldi]

Summary

• update transitive idna lockfile resolution from 3.13 to 3.16
• address Dependabot alert GHSA-65pc-fj4g-8rjx / CVE-2026-45409

Dependency path

• idna is transitive through httpx and anyio
• no direct dependency constraint change was needed

Verification

• uv tree --package idna --invert
• make lint
• make format-check
• make typecheck
• make test

---

Note

Low Risk
Low risk because this is a lockfile-only transitive dependency bump, with no application code changes. Runtime behavior could change slightly for URL/IDNA handling in httpx-related paths.

Overview
Bumps the resolved idna package in uv.lock from 3.13 to 3.16 (updating the recorded sdist/wheel URLs and hashes) to address the associated vulnerability advisory.

No direct dependency constraints or application code are modified; only the lockfile resolution changes for this transitive dependency (used via httpx/anyio).

^{Reviewed by Cursor Bugbot for commit 24ca1db. Bugbot is set up for automated code reviews on this repo. Configure here.}