security(deps): drop jupyter from three python packages — 166 alerts, 540 to 374

[jcschaff]

Removes 166 Dependabot alerts — measured against master, not estimated. 540 → 374.

From #2016. jupyter/jupyterlab was declared in [tool.poetry.dependencies] — a runtime
dependency — in three packages, pulling the entire notebook stack into all three lock files:

package	alerts
mistune	41
tornado	39
jupyterlab	19
jupyter-server	16
nbconvert	9

Nothing imports it. No import jupyter, from jupyter, import IPython, or import notebook
in any .py in the repo. What exists is three example notebooks, one per package — presumably the
reason it was added. But anyone opening a .ipynb already has their own Jupyter, and an example
needing a kernel does not make the kernel a runtime dependency of the library.

Why removed, not moved to a dev group

A dev group was the original plan and it would not have worked. Poetry locks all groups, and
Dependabot alerts on locked dev dependencies too — pytest already appears twice in the current
540 with scope=development. Moving Jupyter would have relabelled ~164 alerts runtime →
development without removing a single one.

Only deletion drops them from the lock file. (My original estimate in #2016 attached the
"540 → ~370" figure to the dev-group option; that was wrong, and the number turns out to be right
only for removal.)

Measured, per file

lock file	locked packages	alerts
pythonData	122 → 34	87 → 21
python-restclient	129 → 43	73 → 20
vcell-opt	117 → 34	68 → 21

257 packages leave the three lock files.

Verification

• No source imports any of the 257 dropped packages — checked mechanically, accounting for
  distribution-vs-import name differences (pillow→PIL, beautifulsoup4→bs4, …). This was the
  real risk: requests, urllib3 and certifi were reaching pythonData transitively through
  Jupyter.
• poetry install + pytest green in all three — 168, 8 and 4 tests.
• Re-locked with plain poetry lock, which in Poetry 2.x does not update packages already
  present, so nothing else changed version.

Two notes for reviewers

python-restclient/pyproject.toml is safe to hand-edit despite being a generated project —
pyproject.toml is listed in its .openapi-generator-ignore, so the generator does not overwrite
it. That was the open question flagged in #2016 and it is now answered; the change will not revert
on the next client regeneration.

vcell-opt needs poetry env use 3.10 (as docs/BUILDING.md says). Its lock pins
matplotlib 3.6.2, which has no wheels for Python 3.12 and fails to build there. This is
pre-existing — the pin is byte-identical on master — but it will bite anyone testing this PR with
a default 3.12 interpreter, as it briefly bit me.

Refs #2016

🤖 Generated with Claude Code

https://claude.ai/code/session_018kr8SbzXtwW3gMVUgMfDDt