chore(deps): floor-pin sqlalchemy >=2.0.38, pin ruff exactly, align CI lint

sqlalchemy 2.0.38 switched the aiosqlite file-db pool from NullPool to
AsyncAdaptedQueuePool; _create_engine() passes pool_size/max_overflow on the
SQLite branch, so anything older dies at import. Postgres installs are
unaffected -- the branch is dead there.

The CI lint job ran `pip install ruff` (newest) while requirements-dev.txt
said >=0.8.0, so CI and contributors enforced different rule sets: ruff 0.8.4
reports 32 errors on a tree current ruff calls clean, 30 of them the since-
removed UP038. Pin ruff exactly and have CI install that pin.

requirements-dev.txt

@@ -9,7 +9,12 @@ pytest-timeout>=2.4.0
 # run, and uses recorded durations on subsequent runs (.test_durations).
 pytest-split>=0.9.0
 httpx>=0.27.0
-ruff>=0.8.0
+# Exact pin, deliberately. A floor lets a contributor's older ruff enforce rules
+# the current one has retired (UP038 was removed — PEP 604 in isinstance() is
+# slower than the tuple form), and lets `format --check` disagree between
+# machines. CI's lint job installs this exact line, so local == CI. Bump on
+# purpose, not by resolution order.
+ruff==0.15.20
 pre-commit>=4.0
 
 # Required by pyftpdlib TLS_FTPHandler for mock FTP server tests

requirements.txt

@@ -14,7 +14,13 @@ fastapi>=0.109.0,<0.136.0
 uvicorn[standard]>=0.27.0
 
 # Database
-sqlalchemy>=2.0.0
+# 2.0.38 is a hard floor, not a preference: it changed the aiosqlite dialect's
+# default pool for file databases from NullPool to AsyncAdaptedQueuePool.
+# core/database._create_engine() passes pool_size/max_overflow on the SQLite
+# branch, which NullPool rejects — on <=2.0.37 every SQLite install (and the
+# test suite, which imports the module-level engine) dies at import with
+# "Invalid argument(s) 'pool_size','max_overflow' sent to create_engine()".
+sqlalchemy>=2.0.38
 aiosqlite>=0.19.0
 asyncpg>=0.29.0
 greenlet>=3.0.0
@@ -146,6 +152,9 @@ numpy>=1.24.0
 pytest>=9.0.3
 pytest-asyncio>=0.23.0
 httpx>=0.26.0
-ruff>=0.2.0
+# Lint/format is pinned exactly in requirements-dev.txt — that file is the
+# source of truth for the version CI enforces. This floor only keeps `ruff`
+# importable for anyone who installs the runtime file alone.
+ruff>=0.8.0
 
 pillow>=12.2.0