Slim production dependencies and fix starlette 1.x compatibility

[hyzyla]

• Drop mypy extra from sqlalchemy — ships the type checker in the runtime image (~55 MB)
• Drop psycopg2 pin — aiopg already requires psycopg2-binary, so it was installed twice
• Bump pyjwt 2.8.0 → 2.13.0, setuptools 68.2.2 → 83.0.0 — CVEs
• Cap httpx <1.0 — pdm resolves 1.0.dev5, which has no httpx.AsyncClient (breaks oidc_auth.py)
• Cap pydantic <2.14 — keeps the lock off the beta
• index.py: pass request= to TemplateResponse — starlette 1.0 dropped the old signature

146 tests pass.