fix(deps): upgrade click and pillow to clear new advisories

pip-audit went red on this branch without a dependency change of ours: the click
and pillow advisories were published after the branch's last green run, and
main carries the identical versions. Both have patched releases, so they are
upgraded rather than added to the ignore list (which is reserved for advisories
with no fix available).

- click 8.3.2 -> 8.4.2 (PYSEC-2026-2132)
- pillow 12.2.0 -> 12.3.0 (PYSEC-2026-2253 through -2257)

typer stays on 0.25.1; the lazy CLI subgroups were verified to still populate
after the click minor bump.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GfjxrHsHYH2TqjwgEcq6oS

Author: berntpopp