chore: upgrade Python to 3.14 and refresh deps to 7-day-safe versions

[spalen0]

Summary

Upgrade the runtime to the newest stable Python and re-pin all dependencies to the newest versions that satisfy the repo's 7-day supply-chain rule (exclude-newer = "1 week").

Changes

• Python 3.14.7: requires-python = ">=3.14", ruff target-version = "py314", mypy python_version = "3.14". (3.14.8 was released today and is still inside the 7-day window; 3.15 is only at rc2.)
• All deps re-pinned from a fresh uv lock under the 7-day window, including majors that tests verified: web3 7.16.0 → 8.0.0, openai 2.29.0 → 3.19.2, httpx2 2.3.0 → 2.13.1 (clears PYSEC-2026-3844/3846/3848/3849 + GHSAs from the audit job — the old idna==3.15 pin had been silently blocking that fix), eth-abi 5 → 6, eth-account 0.14, websockets 17.1, rlp 4 → 5, idna 3.20, etc.
• Dev tooling: mypy 2.0.0 → 2.3.1, pytest 9.0.3 → 9.1.1, ruff 0.16.8 (0.16.9 is inside the 7-day window), types-* stubs refreshed, pre-commit ruff-pre-commit rev v0.16.8.
• Formatting drift from py314: ruff now prefers paren-less except tuples (except ValueError, TypeError:); applied across 23 files. No behavior change — py_compile/ast checks pass on every touched file.
• CI: actions/checkout v6 → v7 and astral-sh/setup-uv v7 → v10.2.0 (both real latest tags; note setup-uv has no floating v10 tag).
• VPS install: deploy/install.sh default PYTHON_VERSION 3.12 → 3.14. Deployment/migration steps are handled manually in this session, so no runbook changes.

Verification

• uv run ruff format --check . and uv run ruff check . — clean
• uv run pytest tests/ — 1625 passed, 4 skipped, 48 subtests (local-only failures in TestSafeApiQuota when a real .env is present are pre-existing on the old lockfile too; CI has no .env and passes)
• uv run mypy . — only the pre-existing duplicate-main namespace error, identical on the old lockfile
• CI: test / lint / audit all pass on this branch