Bump pytest to 9 for PYSEC-2026-1845, crud user tests delete their superusers

pytest 8+ collects files and directories together in name order, so crud/
now runs before test_cloud.py and its leftover superusers made adopting the
owner ambiguous.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WgBfkm4rCmtd1T4vHWjEPx

backend/pyproject.toml

@@ -118,7 +118,7 @@ fluksio-worker = { workspace = true }
 
 [dependency-groups]
 dev = [
-    "pytest<8.0.0,>=7.4.3",
+    "pytest<10.0.0,>=9.0.3",
     "mypy<2.0.0,>=1.8.0",
     "ruff<1.0.0,>=0.2.2",
     "prek>=0.2.24,<1.0.0",

backend/tests/crud/test_user.py

@@ -56,6 +56,9 @@ def test_check_if_user_is_superuser(db: Session) -> None:
     user_in = UserCreate(email=email, password=password, is_superuser=True)
     user = crud.create_user(session=db, user_create=user_in)
     assert user.is_superuser is True
+    # A stray superuser makes adopting the owner ambiguous (tests/test_cloud.py).
+    db.delete(user)
+    db.commit()
 
 
 def test_check_if_user_is_superuser_normal_user(db: Session) -> None:
@@ -75,6 +78,8 @@ def test_get_user(db: Session) -> None:
     assert user_2
     assert user.email == user_2.email
     assert jsonable_encoder(user) == jsonable_encoder(user_2)
+    db.delete(user)
+    db.commit()
 
 
 def test_update_user(db: Session) -> None:
@@ -91,6 +96,8 @@ def test_update_user(db: Session) -> None:
     assert user.email == user_2.email
     verified, _ = verify_password(new_password, user_2.hashed_password)
     assert verified
+    db.delete(user)
+    db.commit()
 
 
 def test_authenticate_user_with_bcrypt_upgrades_to_argon2(db: Session) -> None: