Fix all npm audit vulnerabilities (lockfile only) (#316)

`npm audit fix` resolves all 19 reported advisories (2 critical, 7 high,
9 moderate, 1 low) — vitest/vite UI RCE & path traversal, qs DoS (via
express/body-parser), and postcss XSS. Transitive/dev updates only;
package.json semver ranges are unchanged, so this is a low-risk
lockfile-only bump. Build and full test suite pass; 0 vulnerabilities
remain.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: ksinder