security: bump tornado 6.5.5 -> 6.5.7 in uv.lock

Resolves residual medium/low Dependabot alerts (PIN-28):
- tornado #78 (medium, CVE-2026-...) and #75 (low) — transitive dev/test dep.

Verified: uv lock --upgrade-package tornado (only tornado changed) and
uv sync --frozen succeeds.

Remaining python-sdk medium alerts #73/#74 (pyo3 0.24 -> 0.29, rust/Cargo.toml +
Cargo.lock) are a breaking Rust migration (allow_threads -> detach, Bound API)
and are tracked separately.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jhamon