certifi==2026.5.20 conflicts with aiocryptopay 0.4.8, which hard-caps
certifi<2024.0.0, so pip could not resolve and the Docker image build
failed. Revert to the transitive certifi; PYSEC-2024-230 stays unfixable
until aiocryptopay relaxes its cap. Keeps the PyJWT 2.13.0 bump.