deps: bump nltk to 3.10.3

[katsugtgz]

Updates nltk to address the advisories reported for 3.9.1.

Evidence:

• backend/pyproject.toml pinned nltk==3.9.1
• OSV reports 24 advisories for nltk 3.9.1, including GHSA-7p94-766c-hgjp (critical), GHSA-848c-c2cx-j7qx, GHSA-h8wq-7xc4-p3qx, GHSA-469j-vmhf-r6v7, and PYSEC-2026-3582 through PYSEC-2026-3584
• updated version: 3.10.3

Validation:

• OSV reports no advisories for nltk 3.10.3
• uv lock --check passes on the updated lockfile (389 packages resolved)
• uv tree --package nltk resolves to 3.10.3 with defusedxml 0.7.1 as its new direct dependency

Scope: backend/pyproject.toml and backend/uv.lock only (2 files, +15/-5). The lock edit is surgical: the nltk entry, its specifier, and the new defusedxml entry. No full relock was attempted because the base lockfile was already out of sync before this change (uv lock --check fails on main too).

Supersedes #200, closed due to corrupted branch history on my side. Same intended change.