[eric] backend: pin the six previously-unpinned requirements (jsonschema, fastapi, pillow, httpx, trafilatura, tzlocal) to the exact versions baked into the last working packaged build so deps-pinned passes and reproducibility actually matches the header comment

backend/requirements.txt

@@ -8,18 +8,18 @@
 #   pydantic 2.13.3    — required floor for mcp >=1.27
 anthropic==0.97.0
 claude-agent-sdk==0.1.70
-jsonschema
-fastapi[standard-no-fastapi-cloud-cli]
+jsonschema==4.26.0
+fastapi[standard-no-fastapi-cloud-cli]==0.136.3
 pydantic==2.13.3
 typeguard==4.4.2
 python-dotenv==1.1.1
-Pillow
-httpx>=0.27.0
-trafilatura
+Pillow==12.2.0
+httpx==0.28.1
+trafilatura==2.0.0
 # tzlocal: dev-mode fallback for resolving the user's IANA timezone when
 # Electron's OPENSWARM_TIMEZONE env var isn't set (i.e. `bash run.sh`).
 # Packaged builds get the env var directly so this is a safety net.
-tzlocal
+tzlocal==5.3.1
 # Test deps (pytest, pytest-asyncio) live in requirements-dev.txt — they
 # never ship to production users and shaved ~3 MB / ~200 files off the
 # Mac DMG when removed from the prod env.