Fix CVE-2025-71176: upgrade pytest to ^9.0.3

Bump pytest ^7.2.2 -> ^9.0.3 (CVE-2025-71176, medium severity, fixed
in 9.0.3; locked at 9.1.1). This required pytest-asyncio ^1.3 (older
versions cap pytest below 9) which in turn needs typing-extensions
>=4.12, so the stale typing-extensions 4.6.0 pin is relaxed to
>=4.12,<5. requirements.txt updated to match. All 55 tests pass.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TjjSMyvjymxtXMYFQ1NKbu

Author: claude