Bump the pip-minor group across 1 directory with 6 updates

---
updated-dependencies:
- dependency-name: aiohttp
dependency-version: 3.14.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: pip-minor
- dependency-name: fastapi
dependency-version: 0.143.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: pip-minor
- dependency-name: google-genai
dependency-version: 2.30.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: pip-minor
- dependency-name: pyflakes
dependency-version: 4.0.3
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: pip-minor
- dependency-name: sentry-sdk
dependency-version: 2.72.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: pip-minor
- dependency-name: tzdata
dependency-version: '2026.5'
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: pip-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

requirements-dev.txt

@@ -10,7 +10,7 @@
 # разработчика. Пин версии как и у остального — воспроизводимость гейта.
 -r requirements.txt
 pytest==9.1.1
-pyflakes==4.0.1
+pyflakes==4.0.3
 # pip-audit — сканирование requirements.txt на известные CVE (см. CI workflow
 # .github/workflows/ci.yml) — часть аудита техдолга (dependency debt): версии
 # зависимостей зафиксированы через == (см. requirements.txt) и без отдельной

requirements.txt

@@ -25,10 +25,10 @@
 # опубликованы 8 CVE (CVE-2026-111063/64/65/66/48/49/50 + GHSA-2g87-pp6c-29x5),
 # pip-audit в CI из-за них краснел. Патч-версия: тесты на 3.14.4 зелёные
 # (999 passed), но после деплоя нужен ручной смок /diag + основные команды.
-aiohttp==3.14.4
+aiohttp==3.14.5
 aiogram==3.31.0
-fastapi==0.142.2
-google-genai==2.27.0
+fastapi==0.151.0
+google-genai==2.31.0
 mutagen==1.48.1
 uvicorn==0.54.0
 # tzdata — python:3.13-slim (see Dockerfile) ships no system timezone database
@@ -38,10 +38,10 @@ uvicorn==0.54.0
 # safely (see try/except in _current_quota_day), but then the quota reset
 # drifts 7-8 hours off Google's real reset — with this package it lands right.
 # Pure-pip IANA tzdb data, no compilation — does not bloat the image.
-tzdata==2026.4
+tzdata==2026.5
 # sentry-sdk — optional (see SENTRY_DSN in bot.py) persistent error tracking:
 # bot.log lives on the ephemeral HF Spaces disk and is lost on every redeploy
 # (see README, "Known limitations" — that used to be the only open item there).
 # Without SENTRY_DSN, sentry_sdk.init() is never called — the package just
 # sits unused and changes nothing for whoever did not configure it.
-sentry-sdk==2.71.0
+sentry-sdk==2.72.0