chore(deps): security bump cryptography, aiohttp, pyasn1, setuptools

[edycutjong]

Resolves 22 of 23 open Dependabot alerts on uv.lock.

package	before	after	alerts closed
cryptography	48.0.0	50.0.0	#13, #21, #22, #23
aiohttp	3.13.5	3.14.3	#2–#12, #18, #19, #20
pyasn1	0.6.3	0.6.4	#14, #15, #17
setuptools	82.0.1	83.0.0	#16

Dependabot's own PRs for these (#12, #13, #15, #16) were closed during a bulk PR cleanup and their branches deleted, so this re-applies the fixes in one lockfile change.

Side effects (intentional)

The lock was stale relative to pyproject.toml: commit f589ad9 tightened injective-py to >=1.7.0,<1.12.0 but never re-locked, so uv.lock still pinned 1.14.1 — a version the declared constraint forbids and that CI (pip install -e '.[dev]') never installed. Re-locking corrects it to 1.11.2 and adds pyright/nodeenv from the dev extra.

Verification

cryptography 48→50 is a major bump, so it was run locally before opening this PR:

• ruff check . — all checks passed
• pytest --cov — 109 passed, 100.00% coverage (the fail_under = 100 gate holds)

Not fixed

Alert #1 (ecdsa, high) has no patched version — upstream will not fix the Minerva-class timing side channel. It is transitive via injective-py and hdwallets, with no safe bump available.

[edycutjong]

CI status: blocked by a pre-existing, unrelated failure — not merging.

check	result
`ci (3.11)`	pass (109 tests, 100% coverage)
`ci (3.12)`	cancelled (fail-fast from 3.13)
`ci (3.13)`	fail — in Install dependencies, before any test runs
`CodeQL` / `Analyze (python)`	pass

The 3.13 failure is not caused by this PR

This PR changes uv.lock only (1 file). CI runs pip install -e ".[dev]", which reads pyproject.toml and never reads uv.lock — so this diff cannot influence the install step that fails.

Root cause: coincurve has no cp313 wheels at 20.0.0, and its sdist build fails on modern scikit-build-core:

ERROR: Use build.verbose instead of cmake.verbose for scikit-build-core >= 0.10
ERROR: Failed to build 'coincurve' when getting requirements to build wheel

The chain is injective-py → bip32 → coincurve<21,>=15.0. coincurve 21.0.0 does ship cp313 wheels, but bip32 5.0.0 (latest) still caps at <21, so no injective-py version escapes this. Python 3.13 is uninstallable for this tree until bip32 widens its range upstream.

Unblock options (human decision — not applied here)

1. Drop "3.13" from the CI matrix. pyproject.toml classifiers only claim 3.11 and 3.12, so the matrix currently tests a version the package does not advertise.
2. Add continue-on-error: true for the 3.13 leg.
3. Wait for bip32 to relax coincurve<21.

The cryptography 48→50 bump itself is verified

• ci (3.11) passed on this branch, and because CI resolves fresh from PyPI it installed cryptography 50.
• Locally against the new lock (Python 3.11.15): ruff check . clean, pytest --cov → 109 passed, 100.00% coverage (the fail_under = 100 gate holds).

No API breakage from cryptography 50 was observed. Once the 3.13 matrix leg is resolved, this is safe to merge.