[Lucas1479]

What and why

The required dependency audit now rejects main's aiohttp 3.14.3 pin following
the published advisories. Update aiohttp to 3.14.4 and its minimum required yarl
to 1.25.1. These are the only two changed package versions in the lock.

This extracts the dependency-only patch from draft #237 so security maintenance
does not depend on the Japanese pronunciation resource review.

Upstream: advisory,
3.14.4 release.

Change class

• Routine dependency maintenance

Owning layer: dependency pins and generated lock.

User-visible effect: patched HTTP dependencies; no feature/configuration change.

Compatibility: yarl's required minimum follows aiohttp. Speech/GPU pins and
optional profile selections are unchanged.

Evidence

• Clean main-based branch: 98 profile/environment, loopback HTTP and gateway
  lifecycle tests passed.
• uv lock --check --offline passes; inspected lock changes show only aiohttp
  3.14.3 → 3.14.4 and yarl 1.24.5 → 1.25.1.
• Exported locked core/dev requirements pass pip-audit with the existing pytest
  exception unchanged; no new vulnerability suppression.
• The same dependency patch also passed all 18 checks on feat(tts): add checked Japanese dictionary and default-off reading experiment #237's e59c6fc head.
  This PR's fresh CI is tracked independently.

Final check

• One coherent maintenance change, two source files only
• No runtime fallback, feature, model, voice material or local state included