fix(deps): upgrade pip to 26.2.1 for security fix (dev only)

Resolves a medium severity Dependabot alert: pip would incorrectly
handle doubly-encoded package URLs from indexes. Transitive dev
dependency via pip-api (pip-audit).

GHSA-qwm4-qh6w-59xr

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: matrixise

requirements/dev.txt

@@ -149,7 +149,7 @@ pillow-heif==1.3.0
     # via
     #   -c requirements/main.txt
     #   willow
-pip==26.1.2
+pip==26.2.1
     # via pip-api
 pip-api==0.0.34
     # via pip-audit