[maxexcloo]

The current 1.2.1 image contains cryptography 46.0.7 (with OpenSSL 3.5.6) and Pillow 12.3.0. Raise the package minimums to cryptography 48.0.1 and Pillow 13.0.0, which include the published security fixes, and update the existing lockfile. Pillow is also brought in by python-roborock's map-parser dependencies, so its minimum must be constrained even though this server does not import it directly.

Refresh installed Debian packages, pull the current Python base in validation/release builds, and fetch the acme.sh 3.1.6 release instead of its moving master branch.

References #235, cryptography's advisory, and Pillow's 13.0.0 security fixes. This confirms dependency versions requiring updates; it does not claim a demonstrated exploitable path in the server.

Validation:

• Existing locked Python 3.13 suite: 458 passed; the existing unknown pytest asyncio option warning remains.
• Isolated linux/amd64 image built successfully. Local HTTP mirror egress was blocked, so only the verification build used HTTPS Debian mirror URLs; that transport-only workaround is not part of this patch.
• Built image reports cryptography 48.0.1, Pillow 13.0.0 and OpenSSL 4.0.1. Packaged CLI --help works.
• Existing full suite inside that fresh Python 3.11 amd64 image: 458 passed. Test-only pytest/httpx/PyYAML were installed in a disposable container; production dependencies were unchanged. Warnings were the existing pytest asyncio option and a Starlette/httpx deprecation.
• git diff --check passed.

A new image/app release is still needed to fix installed containers. Both registry tags currently match the image digests running in the affected installation; repulling the existing tag will not update those dependencies. No live server or vacuum state was changed during verification.