fix(deps): align contradictory psutil/Flask-Limiter/freetype-py pins

requirements.txt's optional-install comment recommended psutil>=5.9,<6.0
while web_interface/requirements.txt hard-requires >=6.0,<7.0 — anyone
following the comment ends up with an unsatisfiable pair. The comment now
recommends the same range the web interface requires (all psutil APIs
used — Process, boot_time, cpu_percent, disk_usage, virtual_memory — are
stable in 6.x). Flask-Limiter gains the same <4.0 cap in both files and
freetype-py the same >=2.5.1 floor.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SXb4mKcAkVaxkeTb3YnAdr

requirements.txt

@@ -59,7 +59,9 @@ mypy>=1.5.0,<2.0.0
 # psutil            — per-plugin resource monitoring in
 #                     src/plugin_system/resource_monitor.py. The monitor
 #                     silently no-ops when missing (PSUTIL_AVAILABLE = False).
-#   pip install 'psutil>=5.9.0,<6.0.0'
+#                     Note: web_interface/requirements.txt requires this
+#                     range as a hard dependency — keep the two in sync.
+#   pip install 'psutil>=6.0.0,<7.0.0'
 #
 # Flask-Limiter     — request rate limiting in web_interface/app.py
 #                     (accidental-abuse protection, not security). The

web_interface/requirements.txt

@@ -6,7 +6,7 @@
 flask>=3.1.3,<4.0.0
 werkzeug>=3.1.6,<4.0.0
 flask-wtf>=1.2.0  # CSRF protection (optional for local-only, but recommended)
-flask-limiter>=3.5.0  # Rate limiting (prevent accidental abuse)
+flask-limiter>=3.5.0,<4.0.0  # Rate limiting (prevent accidental abuse)
 flask-compress>=1.14  # gzip/brotli response compression (big win for the large JS/HTML over WiFi)
 
 # WebSocket support for plugins
@@ -26,7 +26,7 @@ Pillow>=12.2.0,<13.0.0
 psutil>=6.0.0,<7.0.0
 
 # Font rendering
-freetype-py>=2.5.0,<3.0.0
+freetype-py>=2.5.1,<3.0.0
 
 # Numerical operations
 # NumPy 1.24+ required for Python 3.12+ compatibility (compatible with 2.x)