chore(deps): bump websockets to 16.0 and setup-python to v6

Closes Dependabot PRs #13 (websockets) and #1 (setup-python).

websockets: 15.0.1 -> 16.0
  Major bump but the API we use (serve(handler), handler arg
  exposing request.path, ws.send, close(code, reason)) is
  unchanged. Verified by running the existing 89-test suite
  against websockets==16.0 locally — _ws_token_ok still reads
  the query string as before.

actions/setup-python: v5 -> v6
  First-party action, low risk. The previous version was already
  tag-pinned (acceptable for first-party). cache: 'pip' input is
  preserved.

pip-audit remains clean (0 known vulnerabilities).

.github/workflows/pylint.yml

@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'pip'

requirements.txt

@@ -15,5 +15,5 @@ pydantic-settings==2.14.1
 python-dotenv==1.2.2
 typing-inspection==0.4.2
 typing_extensions==4.15.0
-websockets==15.0.1
+websockets==16.0
 yarl==1.23.0