fix: resolve dependency security alerts

[gcharang]

Summary

• replace the unmaintained PyPDF2 dependency with pypdf across the API and pinned PageIndex runtime
• preserve truthful artifact identity for the PyMuPDF single-page shortcut and pypdf multi-page path
• override brace-expansion to the patched 5.0.8 release under the existing seven-day quarantine
• fix relative PageIndex installer patch resolution and add provider-free regression coverage

Verification

• make api-check docs-check
• make playwright (20 passed, 1 authorized live test skipped)
• make docker-build
• TEST_POSTGRES_PORT=55433 make test-integration-stack (27 passed)
• full repository CI gates completed locally; clean-code, architecture, and QA review lanes clean