fix: cap search/graph extras to client versions compatible with the shipped compose

Live smoke against docker-compose.full.yml (Elasticsearch 8.14, Neo4j 5.22)
found the 'search' extra 'elasticsearch>=8.0' resolves to the 9.x client, which
refuses an 8.x server (major-version/product check) — so uv sync --extra search
then MEMTRACE_RETRIEVAL_HYBRID_BACKEND=elasticsearch silently degraded. Cap
elasticsearch>=8.0,<9 (and neo4j>=5.0,<7 defensively) to match the shipped
services. Verified end-to-end: smoke passes all three checks (ES BM25 ranking,
Neo4j distance-weighted neighbors, and the full RetrievalController routing
through ES with max bm25=1.0).

Author: MicroYui

pyproject.toml

@@ -44,10 +44,12 @@ telemetry = [
     "opentelemetry-exporter-otlp>=1.25",
 ]
 search = [
-    "elasticsearch>=8.0",
+    # Cap below 9: the elasticsearch 9.x client refuses an 8.x server (product/
+    # version check), and docker-compose.full.yml ships Elasticsearch 8.x.
+    "elasticsearch>=8.0,<9",
 ]
 graph = [
-    "neo4j>=5.0",
+    "neo4j>=5.0,<7",
 ]
 jwt = [
     "PyJWT>=2.8",