chore: dependency security audit on the default branch

Context

Automated dependency scanning has accumulated a backlog of alerts on the default branch. For a project positioning itself around production reliability (Discussion #900), dependency hygiene is part of the product story, not just maintenance.

Tasks

• Triage all open Dependabot alerts: classify by runtime vs dev/build-only dependency and by actual exploitability in this codebase (many alerts in transitive dev dependencies have no runtime exposure).
• Upgrade or pin runtime dependencies with applicable advisories first.
• Batch dev-dependency updates where majors allow; dismiss non-applicable alerts with a stated reason.
• Verify npm run build, npm test, and npm run test:integration pass after upgrades.
• Consider enabling Dependabot grouped security PRs to keep the backlog from re-accumulating.

Acceptance

Zero open critical/high alerts that affect runtime code paths; remaining alerts dismissed with documented reasoning.