Require Pillow 12.3.0 or newer at install time

[JE-Chen]

Follow-up to the Pillow bump in #103.

That PR raised uv.lock to 12.3.0, which cleared the Dependabot alerts, but
the lockfile only constrains the uv environment. pyproject.toml declared
Pillow with no bound, so anyone installing the published package resolved
whatever version PyPI happened to serve — including vulnerable ones, if a
constraint elsewhere in their environment held Pillow back.

This adds the floor where it actually binds installers:

File	Before	After
pyproject.toml	Pillow	Pillow>=12.3.0
requirements.txt	Pillow	Pillow>=12.3.0
dev_requirements.txt	Pillow	Pillow>=12.3.0

dev.toml is deliberately untouched — je_web_runner_dev does not declare
Pillow at all, because the imaging paths (visual_ai, ocr_assert,
visual_regression) import PIL lazily. Adding it there would be a new
dependency, not a bound.

Compatibility

12.3.0 publishes wheels for cp310 through cp315, so the floor excludes no
interpreter covered by requires-python = ">=3.10".

Verification

Built the wheel and confirmed the constraint reaches the published metadata,
which is what installers actually read:

Requires-Python: >=3.10
Requires-Dist: selenium>=4.0.0
Requires-Dist: requests
Requires-Dist: python-dotenv
Requires-Dist: webdriver-manager
Requires-Dist: defusedxml
Requires-Dist: Pillow>=12.3.0

twine check PASSED. Test suite: 4375 passed, 9 skipped, 22 subtests passed.

Note this one should publish normally — unlike the dependency PRs, it changes
the package's install contract.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}