chore(deps): pin aiohttp >=3.14.0 for CVE-2026-34993 + CVE-2026-47265

  pywebpush brings aiohttp in transitively with no version bound, so the
  resolver kept installing 3.13.5. Both CVEs are fixed in 3.14.0; direct
  floor pin here, same shape as the existing idna / urllib3 / starlette
  transitive pins. Our usage in services/external_camera.py is unaffected
  by 3.14.0 (ClientSession, ClientTimeout, ClientError, iter_chunked all
  unchanged); 29 external_camera tests pass on 3.14.1; pip-audit clean.

requirements.txt

@@ -101,6 +101,14 @@ urllib3>=2.7.0
 # directly to stop the resolver from picking the vulnerable build.
 starlette>=1.0.1
 
+# Transitive of pywebpush (unpinned `aiohttp` requirement). aiohttp 3.13.5
+# has CVE-2026-34993 and CVE-2026-47265, both fixed in 3.14.0. pywebpush
+# doesn't declare an upper bound either way, so without this pin the
+# resolver keeps installing the vulnerable 3.13.x line. Our direct usage
+# in services/external_camera.py (ClientSession, ClientTimeout, ClientError,
+# iter_chunked) is unaffected by 3.14.0.
+aiohttp>=3.14.0
+
 # Plate Detection (optional - enables build plate empty detection)
 opencv-python-headless>=4.8.0
 numpy>=1.24.0