fix: cap huggingface-hub <0.30 and diffusers <0.35 so gradio 4.44 oauth works

Gradio 4.44.0 (the last 4.x — 5.x broke ImageEditor) imports HfFolder
from huggingface_hub. HfFolder was removed in newer hub versions, so
the app crashed on import.

The compatibility window:
- huggingface-hub >=0.27.0 (diffusers 0.34 floor) <0.30.0 (HfFolder still present)
- diffusers >=0.34.0 (WanVACEPipeline floor) <0.35.0 (so its hub floor stays at 0.27)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

requirements.txt

@@ -8,7 +8,12 @@
 gradio>=4.44.0,<5.0.0
 fastapi==0.112.2
 starlette==0.37.2
-huggingface-hub>=0.27.0       # diffusers 0.34+ requires this floor
+# Window:
+#   - >=0.27.0 — diffusers 0.34 floor
+#   - <0.30.0 — keep HfFolder importable for gradio 4.44.0's oauth.py
+#     (gradio 5 dropped HfFolder usage but its ImageEditor format is
+#      incompatible with _get_mask_from_editor, so we stay on 4.x)
+huggingface-hub>=0.27.0,<0.30.0
 pydantic<2.9.0
 numpy>=1.24.0,<2.0.0
 Pillow>=9.5.0,<10.0.0
@@ -20,7 +25,9 @@ simple-lama-inpainting>=0.1.2
 # ── Quality mode (VACE-14B) ───────────────────────────────────────────────
 # torch / torchvision are pre-installed on ZeroGPU; do not pin here.
 # diffusers must be >=0.34.0 for WanVACEPipeline (merged in PR #11582).
-diffusers>=0.34.0
+# Capped at <0.35: 0.35+ requires huggingface-hub>=0.34.0, which is past
+# the HfFolder removal point and breaks gradio 4.44.0's oauth import.
+diffusers>=0.34.0,<0.35.0
 transformers>=4.44.0
 accelerate>=0.33.0
 sentencepiece>=0.1.99