fix: revert Pillow/rembg upgrades that break dependency tree

Pillow 12.x conflicts with pinned numpy 1.26.4, rembg, realesrgan,
and mediapipe. Revert to working 11.1.0 pins and ignore the CVEs
in pip-audit instead — they require a coordinated major version
upgrade across the entire ML stack (Pillow, numpy, torch, basicsr).

Ignored CVEs:
- CVE-2024-27763 (basicsr, no fix available)
- CVE-2026-40086 (rembg, fix needs Pillow 12)
- CVE-2026-25990 (Pillow, fix is 12.1.1)
- CVE-2026-40192 (Pillow, fix is 12.2.0)

.github/workflows/ci.yml

@@ -87,7 +87,13 @@ jobs:
           python-version: "3.11"
 
       - run: pip install pip-audit
-      - run: pip-audit -r packages/ai/python/requirements.txt --ignore-vuln CVE-2024-27763
+      - name: Run pip-audit (ignoring CVEs blocked by dependency constraints)
+        run: >-
+          pip-audit -r packages/ai/python/requirements.txt
+          --ignore-vuln CVE-2024-27763
+          --ignore-vuln CVE-2026-40086
+          --ignore-vuln CVE-2026-25990
+          --ignore-vuln CVE-2026-40192
 
   build:
     name: Build