Bump to Python 3.14.3-slim, fix 9 CVEs, remove leaked PyPI token

- Dockerfile: python:3.13-slim -> python:3.14.3-slim (stable as of Feb 2026)
- certifi: 2023.7.22 -> >=2024.7.4 (CVE-2024-39689, LOW)
- idna: 3.4 -> >=3.7 (CVE-2024-3651, MEDIUM)
- requests: 2.32.0 -> >=2.32.4 (CVE-2024-47081, MEDIUM)
- urllib3: 2.0.6 -> >=2.6.3 (6 CVEs including 3 HIGH decompression/redirect)
- Add app/.pypirc and .pypirc to .gitignore to prevent future token leaks

NOTE: PyPI token was previously committed at 21f32e5 - rotate at pypi.org.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/requirements.txt

@@ -3,9 +3,9 @@ annotated-types==0.6.0
 async-timeout==4.0.3
 backoff==2.2.1
 cachetools==5.3.1
-certifi==2023.7.22
+certifi>=2024.7.4
 charset-normalizer==3.3.0
-idna==3.4
+idna>=3.7
 monotonic==1.6
 prompt-toolkit==3.0.39
 pydantic>=2.9.0
@@ -13,9 +13,9 @@ Pygments==2.16.1
 python-dateutil==2.8.2
 pyvim==3.0.3
 pyvmomi==9.0.0.0
-requests==2.32.0
+requests>=2.32.4
 six==1.16.0
 tinydb==4.8.0
 typing_extensions>=4.12.2
-urllib3==2.0.6
+urllib3>=2.6.3
 wcwidth==0.2.8