Updated backend

requirements.txt

@@ -7,6 +7,13 @@ python-multipart>=0.0.6
 # --- Config ---
 python-dotenv>=1.0.1
 
+# --- Authentication ---
+# Signs/verifies the access tokens issued by /api/auth/login. Pure Python, no
+# compiled extension - nothing extra to build on the slim image. Password
+# hashing uses hashlib.pbkdf2_hmac from the standard library, so there is
+# deliberately no bcrypt/argon2/passlib dependency here.
+PyJWT>=2.9.0
+
 # --- Database / pgvector ---
 psycopg[binary]>=3.2.3
 pgvector>=0.2.5
@@ -57,3 +64,8 @@ joblib>=1.4.2
 
 # --- Dev/test tooling ---
 pytest>=8.3.3
+# Starlette's TestClient deprecates the httpx 0.x backend and emits a
+# StarletteDeprecationWarning without this. pytest.ini turns warnings into
+# errors, so it is a hard requirement of the suite, not a nicety. Test-only:
+# the application itself uses the `httpx` pinned above.
+httpx2>=2.10.0