Update dependencies and fix bot-mail suppression under Flask-Security 5.9

[mreid-tt]

Summary

Refresh the dependency lock (33 packages) and fix the one behavioural regression the upgrade surfaced.

Dependency update (uv lock --upgrade)

Notable direct bumps:

• SQLAlchemy 2.0 → 2.1
• Flask-Security 5.8 → 5.9
• Flask-Admin 2.2.0 → 2.2.1
• Celery → 5.6
• python-gnupg, boto3, and ~28 transitive packages

Fix: bot-mail suppression (spkrepo/mail.py)

Flask-Security 5.9 changed how the "existing email/username" registration mails are addressed: they were hardcoded bare names ("welcome_existing"), now they come from config as full paths ("security/email/welcome_existing"). Our suppression set holds bare names, so it stopped matching and the bot-triggered mails would have been sent again.

SpkrepoMailUtil.send_mail now matches on the template's base name (template.rsplit("/", 1)[-1]), so the suppression holds regardless of where Flask-Security keeps its templates.

Verification

• pytest — 380 passed, 45 subtests.
• sphinx-build -W -b html clean (pydata-sphinx-theme / docutils also bumped).
• pre-commit clean.