fix(dashboard): clean up upload temp file on client disconnect + pin python-multipart (NS-501)

[kshitijk4poor]

Follow-up to #47663 (NS-501)

#47663 (streaming multipart upload for the dashboard file manager) merged as c66163453. This is a tight follow-up fixing two issues that landed with it. No feature/frontend changes — only the two fixes below + a regression test.

#	Issue on main	Fix
1	Temp file leaks on client disconnect. upload_managed_file_stream's except chain catches only HTTPException / PermissionError / OSError — all Exception subclasses. asyncio.CancelledError (raised when a browser aborts a large upload mid-stream — the exact NS-501 scenario) is a BaseException, so it bypasses every except and reaches a finally that only closes the file handle and never unlinks the temp file. Every aborted large upload orphans a partial .{name}.*.upload file (up to ~100 MB) in the target directory.	Cleanup moved into finally, keyed on a renamed success flag, so the temp file is removed on every non-success exit including BaseException. (os.replace clears tmp_path on success, so we only unlink when the rename didn't happen.)
2	python-multipart needlessly downgraded. The package was already resolved at 0.0.27 transitively (via daytona) before #47663; the explicit ==0.0.20 pin in the [web] extra + tool.dashboard lazy-install set downgraded it.	Bumped both pins to ==0.0.27 and regenerated via uv lock (Updated python-multipart v0.0.20 -> v0.0.27). Base dep stays >=0.0.9,<1. uv lock --check passes. (0.0.20 was past CVE-2024-53981 too, so this is lockfile hygiene, not a security fix.)

Validation

• New test test_stream_upload_cleans_temp_on_cancellation — mutation-tested against current main: it fails on the merged code (leaks .aborted.bin.*.upload) and passes with the fix. It invokes the endpoint coroutine directly so the BaseException propagates instead of being swallowed by the test client.
• 77 tests green across the file-server + lazy-deps suites; ruff check clean.
• uv lock --check passes; python-multipart resolves to 0.0.27 (no downgrade).

Diff is scoped to 5 files (+67/-9): hermes_cli/web_server.py, pyproject.toml, tools/lazy_deps.py, uv.lock, tests/hermes_cli/test_web_server_files.py.

Reviewer notes

Touches pyproject.toml / tools/lazy_deps.py / hermes_cli/web_server.py (a dependency pin + dashboard API surface), so this is out of the pure-Docker lane → flagging for Teknium review.

Follow-up to #47663. Surfaced during review of #47663.

[github-actions]

🔎 Lint report: fix/ns501-multipart-upload-salvage vs origin/main

ruff

Total: 0 on HEAD, 0 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 0 pre-existing issues carried over.

ty (type checker)

Total: 10997 on HEAD, 10997 on base (➖ 0)

🆕 New issues: none

✅ Fixed issues: none

Unchanged: 5763 pre-existing issues carried over.

Diagnostics are surfaced as warnings — this check never fails the build.

[alt-glitch]

Related: #47663 (original by @benbarclay, this is the cherry-pick onto current main with authorship preserved via Co-authored-by), #43772 (sibling dashboard multipart-upload work). Salvage/cherry-pick — authoritative current version, not a duplicate.