fix: downgrade FastAPI and PySpark for Python 3.9 compatibility

[devin-ai-integration]

Summary

The pyproject.toml declares python = "^3.9" but the previous dependency constraints pulled in versions that dropped Python 3.9 support:

• FastAPI 0.129.0+ requires Python ≥3.10 (fastapi#14897)
• PySpark 4.1.0+ requires Python ≥3.10 (SPARK-52561)

This caused poetry lock / poetry install to fail on macOS with the built-in Python 3.9.6.

Fix: Pin upper bounds so Poetry resolves to compatible versions:

• fastapi[standard]: ^0.135.3 → >=0.115.0,<0.129.0 (resolves to 0.128.8)
• pyspark: ^4.1.1 → >=4.0.0,<4.1.0 (resolves to 4.0.2)

The lock file is regenerated accordingly (transitive deps like anyio, click, starlette, websockets also shift to Python 3.9-compatible versions).

Review & Testing Checklist for Human

• Verify the app code doesn't use FastAPI features added after 0.128.x — e.g., any imports or parameters introduced in 0.129–0.135. Run the backend locally (poetry install && poetry run fastapi dev app/main.py) and confirm it starts and serves queries
• Confirm openai ^2.31.0 resolves correctly under Python 3.9 — this constraint was not changed but should be verified during poetry install
• Run the full local workflow on your Mac: poetry lock && poetry install && poetry run fastapi dev app/main.py, then open the frontend and submit a test query

Notes

• PySpark 4.0.x and 4.1.x have the same user-facing SparkSQL API for our use case (reading CSVs, running SQL). The 4.1 release was primarily internal/infra changes + the Python 3.9 drop.
• If you later upgrade to Python 3.10+, you can widen these constraints back to ^0.135.3 / ^4.1.1.

Link to Devin session: https://app.devin.ai/sessions/cd4107aa709a4fa4a7fae1ae2d63f039
Requested by: @mail2ghuman

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.