chore(deps): land the services/api updates, websockets 17 included

[L4XB]

What

From	Change
#134	alembic 1.18.5 → 1.19.2
#135	psycopg[binary] 3.3.4 → 3.3.5
#136	sqlalchemy 2.0.51 → 2.0.52
#133	hatchling 1.27.0 → 1.32.0
#137	websockets 16.1.1 → 17.1

Batched because all five touch services/api, whose export manifest binds every
file by SHA-256 and has to be rehashed — something Dependabot cannot do from its
own branch — and because the branch requires checks to be up to date, so merging
them one at a time serialises five full CI cycles.

websockets 17 is the one worth looking at

It is a major bump on the library that carries live interview audio, and it
is a direct dependency, not a transitive one.
services/api/src/sixsentences_server/voice/relay.py:123 subclasses
websockets.asyncio.client.connect to override process_redirect, so the
provider API key can never follow a redirect to an untrusted host.

That matters for how much the test suite is worth here.
test_actual_provider_transport_disables_proxy_and_all_redirects constructs the
real class and asserts connection.proxy is None and that a redirect is
returned unchanged. It is not a mock. A renamed attribute or a changed signature
anywhere in that path fails it at import or assertion time.

So the green suite is evidence rather than reassurance:

tests/test_voice_relay.py tests/test_voice_relay_routes.py  →  95 passed

What it does not cover: no real socket is opened against a provider, so
wire-level behaviour changes in 17.x — framing, close codes, keepalive timing —
would not show up here. The relay's own policy layer (rate limits, budget,
receipts) is exercised, the transport is not.

Verification

uv run ruff check src scripts tests   →  All checks passed!
uv run mypy src                       →  no issues in 208 source files
uv run pytest -q                      →  2901 passed, 1 skipped
audit_community_export.py .           →  404 files, 400 HTTP operations,
                                         1 WebSocket, 89 tables

The audit still resolves the single WebSocket route, which is the other place a
breaking change in the library would have surfaced.

Side note

Dependabot raised #133–#137 against main — after #112 retired develop.
The configuration change took effect on the next run, with nothing orphaned.

[L4XB]

I have read and agree to the SixSentences CLA v1.0.