chore(deps): backend security floor bumps + 422 constant rename

  requirements.txt
    - cryptography 46.0.7 -> 48.0.1 floor (GHSA-537c-gmf6-5ccf,
      non-contiguous Python buffer handling)
    - python-multipart 0.0.27 -> 0.0.31 floor (CVE-2026-53538/53539/53540,
      multipart parser hardening)
    - starlette 1.1.0 -> 1.3.1 floor (CVE-2026-54282/54283, FormParser
      limit enforcement + StaticFiles absolute-path rejection)
    - pyopenssl 26.0.0 -> 26.3.0 floor (NOT a security fix; pyOpenSSL
      <26.3.0 caps cryptography<47 and would otherwise downgrade out
      of the GHSA-537c-gmf6-5ccf fix line)

  backend/app/api/routes/mfa.py
    - 3x HTTP_422_UNPROCESSABLE_ENTITY -> HTTP_422_UNPROCESSABLE_CONTENT
      (the former is deprecated in starlette 1.3.x, same 422 wire status;
       the 2 remaining warnings are inside FastAPI itself, upstream's)

  Release-notes review done before bump: cryptography 47/48 dropped
  binary EC, CFB/OFB/CFB8, Camellia, PUBLIC_KEY_TYPES/PRIVATE_KEY_TYPES,
  OpenSSL 1.1.x, Python 3.8 -- grep clean against every removed surface;
  starlette's newly-enforced max_part_size=1MB only applies to text form
  fields (verified in MultiPartParser.on_part_data), file streams from
  UploadFile = File(...) are unaffected; python-multipart 0.0.30 dropped
  RFC 2231/5987 filename* parsing, minor cosmetic impact on non-ASCII
  filename uploads, plain filename= fallback still works.

backend/app/api/routes/mfa.py

@@ -467,7 +467,7 @@ def _enforce_auto_link_safety(provider: OIDCProvider) -> None:
     """
     if provider.auto_link_existing_accounts and provider.email_claim == "email" and not provider.require_email_verified:
         raise HTTPException(
-            status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
             detail=AUTO_LINK_REQUIREMENTS_ERROR,
         )
 
@@ -1361,7 +1361,7 @@ async def create_oidc_provider(
         grp_chk = await db.execute(select(Group).where(Group.id == body.default_group_id))
         if not grp_chk.scalar_one_or_none():
             raise HTTPException(
-                status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+                status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
                 detail="default_group_id references a non-existent group",
             )
 
@@ -1425,7 +1425,7 @@ async def update_oidc_provider(
         grp_chk = await db.execute(select(Group).where(Group.id == body.default_group_id))
         if not grp_chk.scalar_one_or_none():
             raise HTTPException(
-                status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+                status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
                 detail="default_group_id references a non-existent group",
             )
 

requirements.txt

@@ -31,7 +31,14 @@ aioftp>=0.22.0
 
 # Virtual Printer (emulates Bambu printer for slicer uploads)
 pyftpdlib>=2.0.0
-cryptography>=46.0.7
+# 46.x line has GHSA-537c-gmf6-5ccf; 48.0.1 is the fix release. Upstream's
+# X.509 / PKCS#7 surface is in our trust path via asyncssh, pyOpenSSL,
+# py-vapid, http_ece, pywebpush.
+cryptography>=48.0.1
+# Transitive of asyncssh / pywebpush. pyopenssl<26.3.0 caps `cryptography<47`
+# so without this floor the resolver either downgrades cryptography below
+# the GHSA-537c-gmf6-5ccf fix line or installs an inconsistent pair.
+pyopenssl>=26.3.0
 
 # SpoolBuddy remote SSH updates (pure-Python SSH client; avoids the
 # OpenSSH `ssh` binary which calls getpwuid() and fails in Docker when
@@ -48,7 +55,9 @@ openpyxl>=3.1.0
 pywebpush>=2.0.0
 
 # Utilities
-python-multipart>=0.0.27
+# 0.0.27 → 0.0.31 clears three CVEs in the parser surface that FastAPI
+# uses for multipart form bodies (CVE-2026-53538/53539/53540).
+python-multipart>=0.0.31
 aiofiles>=23.0.0
 
 # QR Code generation
@@ -112,10 +121,11 @@ curl_cffi>=0.7.0
 # would silently keep installing the vulnerable 2.6.x line.
 urllib3>=2.7.0
 
-# Transitive of fastapi. starlette 1.0.0 has PYSEC-2026-161; 1.0.1 is the
-# fixed release. fastapi's range still admits 1.0.0 so we pin the floor
-# directly to stop the resolver from picking the vulnerable build.
-starlette>=1.0.1
+# Transitive of fastapi. starlette 1.0.0 has PYSEC-2026-161; 1.1.x has
+# CVE-2026-54282/54283; 1.3.1 is the fixed release. fastapi's range still
+# admits the vulnerable builds, so we pin the floor directly to stop the
+# resolver from picking them.
+starlette>=1.3.1
 
 # Transitive of pywebpush (unpinned `aiohttp` requirement). aiohttp 3.13.5
 # has CVE-2026-34993 and CVE-2026-47265, both fixed in 3.14.0. pywebpush