chore(release): sync main with dev

* fix(image): pin standalone service model selection

Port the reviewed standalone image-service hardening from dev to the curated release branch and include its focused regressions.

Evidence: all four focused regression tests pass in an isolated runtime, and the staged diff check is clean. Coordinated-disclosure identifiers are intentionally omitted pending publication.

* chore(release): bump version to 1.0.3

Set the canonical application version for the curated hotfix release.

Evidence: APP_VERSION imports as 1.0.3 and the release workflow reads this source. No tag, package, or release artifact is created by this commit.

---------

Co-authored-by: nopoz <bill.lowney@gmail.com>

requirements-optional.txt

@@ -43,4 +43,4 @@ PyMuPDF
 # magika (onnxruntime), already a core dep via fastembed. We avoid the
 # [all]/Azure/audio extras (cloud + heavy). Pinned to a release >30 days old per
 # the dependency-age discussion in issue #485.
-markitdown[docx,pptx,xlsx,xls]==0.1.7
+markitdown[docx,pptx,xlsx,xls]==0.1.6

requirements.txt

@@ -3,9 +3,9 @@ uvicorn
 python-multipart
 python-dotenv
 httpx
-httpcore>=1.0.9,<2.0
+httpcore>=1.0,<2.0
-pydantic>=2.13.5
+pydantic>=2.13.4
-pydantic-settings>=2.15.0
+pydantic-settings>=2.14.1
 SQLAlchemy
 pypdf
 beautifulsoup4
@@ -41,7 +41,7 @@ bcrypt
 # Built-in servers use the v1 low-level Server decorator API. MCP SDK v2 is a
 # breaking rewrite, so keep fresh installs on the maintained v1 line until the
 # servers are migrated together.
-mcp<3
+mcp<2
 pyotp
 qrcode[pil]
 croniter