revert: roll back SQLAlchemy 2.0 upgrade (#42803)

Revert squash commit 8014f782d3 while
preserving the 86 commits subsequently merged to master. Restore SQLAlchemy
1.4.54 and Flask-SQLAlchemy 2.5.1 behavior, including compatible dialect
bounds, ORM/session handling, and warning coverage.

Requirements were regenerated with ./scripts/uv-pip-compile.sh using the
repository's Python 3.11 Docker workflow. The revert applied without textual
conflicts. Post-merge session/savepoint and DuckDB changes were retained and
verified against SQLAlchemy 1.4; no post-#42803 commit required an additional
compatibility change.

tests/unit_tests/sql_lab_test.py

@@ -496,17 +496,7 @@ def test_get_sql_results_oauth2(mocker: MockerFixture, app) -> None:
         "OAuth2 required"
     )
 
-    # `limit` and `select_as_cta_used` must match the real `Query` model's
-    # defaults (nullable Integer -> None, Boolean default=False) so that
-    # `apply_limit` -- called unconditionally before the mocked OAuth2 error
-    # is ever reached -- doesn't try to compare an unconfigured MagicMock
-    # against an int.
-    query = mocker.MagicMock(
-        select_as_cta=False,
-        select_as_cta_used=False,
-        limit=None,
-        database=database,
-    )
+    query = mocker.MagicMock(select_as_cta=False, database=database)
     mocker.patch("superset.sql_lab.get_query", return_value=query)
 
     payload = get_sql_results(query_id=1, rendered_query="SELECT 1")
@@ -519,9 +509,7 @@ def test_get_sql_results_oauth2(mocker: MockerFixture, app) -> None:
     assert error["error_type"] == SupersetErrorType.OAUTH2_REDIRECT
     assert error["level"] == ErrorLevel.WARNING
     assert error["extra"]["tab_id"] == "fb11f528-6eba-4a8a-837e-6b0d39ee9187"
-    assert (
-        error["extra"]["redirect_uri"] == "http://example.com/api/v1/database/oauth2/"
-    )
+    assert error["extra"]["redirect_uri"] == "http://localhost/api/v1/database/oauth2/"
 
     # Parse the OAuth2 authorization URL and verify components individually,
     # since the JWT state and PKCE code_challenge are computed deterministically
@@ -534,7 +522,7 @@ def test_get_sql_results_oauth2(mocker: MockerFixture, app) -> None:
     params = parse_qs(url.query)
     assert params["scope"] == ["refresh_token session:role:USERADMIN"]
     assert params["response_type"] == ["code"]
-    assert params["redirect_uri"] == ["http://example.com/api/v1/database/oauth2/"]
+    assert params["redirect_uri"] == ["http://localhost/api/v1/database/oauth2/"]
     assert params["client_id"] == ["my_client_id"]
     assert params["code_challenge_method"] == ["S256"]