chore(deps): bump aiohttp, lxml, and tomlkit (#32)

Consolidates three reviewed Dependabot bumps into one PR:
- aiohttp 3.13.4 -> 3.13.5 (bugfix patch)
- lxml 6.1.0 -> 6.1.1 (patch; transitive binary-wheel dep)
- tomlkit 0.14.0 -> 0.15.0 (minor; we use only loads/dumps/TOMLKitError)

uv.lock regenerated with no transitive changes. Replaces #2, #19, #5.

Author: elkaix

pyproject.toml

@@ -24,7 +24,7 @@ classifiers = [
 dependencies = [
     "agent-client-protocol==0.8.0",
     "aiofiles>=24.0,<26.0",
-    "aiohttp==3.13.4",
+    "aiohttp==3.13.5",
     "typer==0.21.1",
     "pythinker-core[contrib]==1.1.1",
     # notify-py (via batrachian-toad) caps loguru at <=0.6.0 on 3.14+.
@@ -39,15 +39,15 @@ dependencies = [
     "streamingjson==0.0.5",
     "trafilatura==2.0.0",
     # lxml is used by trafilatura/htmldate/justext; keep pinned for binary wheels.
-    "lxml==6.1.0",
+    "lxml==6.1.1",
     "tenacity==9.1.4",
     "fastmcp==3.2.0",
     "pydantic==2.13.4",
     "httpx[socks]==0.28.1",
     "pythinker-host==1.0.0",
     "pythinker-review==0.1.0",
     "batrachian-toad==0.5.23; python_version >= \"3.14\"",
-    "tomlkit==0.14.0",
+    "tomlkit==0.15.0",
     "jinja2==3.1.6",
     "pyobjc-framework-cocoa>=12.1 ; sys_platform == 'darwin'",
     "fastapi>=0.115.0",