fix: add LangGraph deps to requirements.txt for HuggingFace Spaces

HuggingFace Spaces uses requirements.txt, not pyproject.toml.
Missing langchain-core caused "No module named 'langchain_core'" error.

Added:
- langgraph, langchain, langchain-core, langchain-huggingface
- langgraph-checkpoint-sqlite>=3.0.0 (security fix)
- urllib3>=2.5.0 (security fix)
- huggingface-hub

requirements.txt

@@ -6,10 +6,18 @@ pydantic-ai>=0.0.16
 # AI Providers
 openai>=1.0.0
 anthropic>=0.18.0
+huggingface-hub>=0.20.0
 
 # Multi-agent orchestration (Advanced mode)
 agent-framework-core>=1.0.0b251120
 
+# LangGraph dependencies (SPEC-07/08)
+langgraph>=0.2.50,<1.0
+langchain>=0.3.9,<1.0
+langchain-core>=0.3.21,<1.0
+langchain-huggingface>=0.1.2,<1.0
+langgraph-checkpoint-sqlite>=3.0.0,<4.0
+
 # Web search
 duckduckgo-search>=5.0
 
@@ -26,15 +34,12 @@ python-dotenv>=1.0
 tenacity>=8.2
 structlog>=24.1
 requests>=2.32.5
-limits>=3.0  # Rate limiting (Phase 17)
+limits>=3.0
+urllib3>=2.5.0  # Security fix for GHSA-48p4-8xcf-vxj5
 
 # Optional: Modal for code execution
 modal>=0.63.0
 
-# Optional: LlamaIndex RAG
-llama-index>=0.11.0
-llama-index-llms-openai
-llama-index-embeddings-openai
-llama-index-vector-stores-chroma
+# Optional: Embeddings & Vector Store
 chromadb>=0.4.0
 sentence-transformers>=2.2.0