Add dependency versioning preference to coding standards

SPEC.md

@@ -313,6 +313,7 @@ Format as structured JSON.
 - **Docstrings:** Required on modules and classes
 - **Logging:** Use `logging` module, no `print()` in production
 - **Pre-commit:** Enforce ruff and pytest before commits
+- **Dependencies:** No pinned versions unless required (e.g., `fastapi` not `fastapi==0.109.0`) - prefer latest for security
 
 ### File Structure
 ```