fix(deps): require starlette>=1.0.1 (CVE-2026-48710) and drop unused poetry.lock (#136)

starlette is pulled in transitively by mcp for the streamable-http transport. Versions <= 1.0.0 are affected by CVE-2026-48710 (BadHost), a Host-header validation bypass that can poison request.url.path and bypass path-based auth. Add an explicit starlette>=1.0.1 floor to pyproject.toml and requirements.txt; uv resolves the set to starlette 1.2.1.

The stale poetry.lock pinned starlette 0.46.1 and an outdated mcp 1.6.0; nothing builds from it (Docker and CI install from requirements.txt via uv), so it is removed. This clears the Dependabot alert at its source.

Author: nictuku