chore(release): 0.56.9 dependency and ffmpeg security updates

[ttlequals0]

Patch release rolling up the open dependency work and the ffmpeg pin.

ffmpeg n8.1 -> n9.0 (closes #133)

The static ffmpeg baked into the app image moves from n8.1.2-22-g94138f6973
(built 2026-07-10) to n9.0.1-11-ge47273f4d9 (built 2026-09-01). ffmpeg parses
untrusted audio uploads, and the binary carries no package-database entry, so
trivy never sees it and the weekly upstream monitor is the only signal that
the pin has aged.

The BtbN autobuild asset is mirrored to release tag
ffmpeg-static-n9.0.1-11-ge47273f4d9 and pinned by sha256, same as the old
one. Verified before the pin landed:

• sha256 of the mirrored asset matches the --checksum= value
• the tarball keeps a single top directory, so mv /tmp/ffmpeg-*/bin/ffmpeg still resolves
• the real filter chains from services/audio.py run clean on n9.0: the
  loudnorm measurement pass emits all five keys the parser reads, and both the
  two-pass and single-pass encode paths exit 0
• dynamic linkage is glibc-only (max GLIBC_2.28), satisfied by python:3.14-slim
• 85 ffmpeg-dependent backend tests pass with the n9.0 binary on PATH
• check_ffmpeg.py parses the new token and reports the pin up to date

Dependency updates

Merged separately from the Dependabot queue and included here for the release:
pypdf 6.15.0 to 6.16.1 (three DoS advisories), browserslist 4.28.2 to 4.28.8
and postcss-selector-parser 6.1.2 to 6.1.3, the uv builder image 0.12.3 to
0.12.7, and the setup-uv, build-push-action, and setup-buildx-action CI
actions to their next major.

Accepted CVE

CVE-2026-9856 (transformers, HIGH) added to .trivyignore.tts. It is a
save_pretrained path traversal through a chat template name, fixed in
5.10.0. chatterbox-tts 0.1.7 pins transformers 5.2.0 exactly, so
uv lock --upgrade-package transformers resolves to no change. The wrapper
never calls save_pretrained, and a TTS model carries no chat templates. The
Dependabot alert is dismissed with the same reasoning.

Accepted CVEs from the release gate

Four HIGH findings survived the gate, none with a patched package in Debian
trixie. Each is recorded in the ignorefile for the images it affects:

CVE	Package	Images	Why it is accepted
CVE-2026-11822, CVE-2026-11824	libsqlite3-0	all three	FTS5 memory corruption, reachable only by opening a crafted database and running a MATCH query. No FTS5 tables anywhere, and only the app's own database is ever opened
CVE-2026-66046	libexpat1	tts, render	Quadratic blowup in storeAtts(); nothing here parses untrusted XML
CVE-2026-52490	libtiff6	render	The vulnerable process_command_opts() lives in tools/tiffcrop.c, shipped by libtiff-tools. The render image installs only libtiff6, so the code is not in the image

After these entries the gate reports all four images CLEAN.

Testing

• backend 1147 passed, tts-wrapper 98 passed, render 35 passed
• ruff check clean, sync_version.py --check clean
• /simplify and /code-review both run; all findings addressed