chore(deps): refresh lockfile (Django 6.1, orjson 3.12, ruff 0.16)

Summary

Routine uv lock --upgrade dependency refresh — lockfile only, no source changes. The pyproject floors are unchanged; django>=6.0 still resolves and still passes, so this doesn't drop 6.0 support.

Notable moves:

package	from	to
django	6.0.6	6.1
orjson	3.11.9	3.12.0
asgiref	3.11.1	3.12.1
django-vcache	3.1.0	3.1.1
granian	2.7.7	2.8.2
ruff	0.15.20	0.16.5
mypy	2.1.0	2.3.1

One thing to note: django-prometheus went backwards

django-prometheus 2.5.0 pins Django!=5.0.*,<6.1,>=4.2, so pulling Django 6.1 forced the resolver back to 2.4.0, which carries no Django bound at all. That's a dev-group-only dependency, used by the sample project's metrics endpoint — nothing in the published django-vtasks package depends on it — so the downgrade doesn't affect users. Worth revisiting once django-prometheus widens its pin.

ruff 0.16.5

CI gates ruff check / ruff format --check on django_vtasks only, and both are clean on 0.16.5 with no source changes. The new ruff does want to reflow files under tests/, sample/ and benchmarks/, which CI doesn't gate — left alone deliberately, since a 26-file reformat would bury a lockfile bump. Happy to do that as a separate MR if wanted.

CI: test-mysql needed a service bump

Django 6.1 raises the minimum MySQL to 8.4 (MariaDB to 10.11), so the job's pinned mysql:8.0 service failed at test-database creation:

django.db.utils.NotSupportedError: MySQL 8.4 or later is required (found 8.0.46)

Bumped the service to mysql:8.4 in the same MR, since it's a direct consequence of the Django bump. Nothing else was affected — lint, both postgres/valkey matrix legs, sqlite, redis-valkey and valkey-cluster all passed on the first run.

No docs change: nothing in the docs claims a MySQL version, and the package floor stays django>=6.0, so MySQL 8.0 remains supported for anyone on 6.0.

Testing

• Full suite against Postgres 18 + Valkey via docker compose run --rm web: 177 tests, OK.
• SQLite job (--exclude-tag valkey), matching the CI job: 160 tests, OK (11 skipped).
• ruff check django_vtasks and ruff format --check django_vtasks on 0.16.5: clean.
• test-mysql job replicated locally against a real mysql:8.4 (8.4.11) — same python:3.12 image and same apt/uv/mysqlclient steps as CI: 46 tests, OK (13 skipped). Also confirmed mysqlclient authenticates against 8.4's default caching_sha2_password.
• Confirmed the container actually resolves to Django 6.1 rather than a stale cached env.

AI disclosure: Claude Code — ran the upgrade, investigated the django-prometheus downgrade, ran the test matrix locally, and drafted this description. Reviewed by me before pushing.