Update npm dependencies for new OSV advisories

[ElbertePlinio]

Problem

PR #65 surfaced newly reported npm advisories in the dependency audit. Its bun.lock is byte-for-byte unchanged from origin/main; the previous successful main CI run predates these advisories.

OSV currently reports 12 fixable vulnerabilities across six packages: 0 critical, 6 high, 5 medium, and 1 low.

Affected versions and minimum fixes:

• brace-expansion 2.1.2 → 2.1.3/2.1.4
• brace-expansion 5.0.8 → 5.0.9
• fast-uri 3.1.4 → 3.1.5
• hono 4.12.27 → 4.12.34
• ip-address 10.2.0 → 10.3.1 for all reported advisories
• nanoid 3.3.16 → 3.3.18

Acceptance criteria

• Update direct pins and transitive lockfile resolutions to fixed versions.
• Keep changes limited to dependency remediation; do not weaken the audit gate.
• bun install --frozen-lockfile passes.
• Typecheck, lint, tests, coverage, and build pass.
• OSV dependency audit passes with no untracked high/critical ignores.
• Record any compatibility risk or unavoidable advisory in osv-scanner.toml with explicit rationale and tracking.
• Unblock PR feat: add Flutter-aware Pickforge doctor #65 without adding dependency churn to its read-only Rust doctor scope.

Evidence

• Failing audit: https://github.com/pickforge/picklab/actions/runs/32054246580/job/95462325755
• Blocked PR: feat: add Flutter-aware Pickforge doctor #65
• Parent alpha: Build the Flutter-first Pickforge integration alpha #64

[ElbertePlinio]

Progress update:

• Updated all six vulnerable package resolutions
• Pinned Bun frozen install, typecheck, lint, and build pass
• OSV v2.3.8 reports no unfiltered advisories
• Serious dependency/security review and targeted verification are clean
• CI full tests, coverage, build, and dependency audit
• Human review and merge

PR: #67
Blocked: none; CI is running.
Next: triage CI, then stop at Ready for human review.

[ElbertePlinio]

Ready for human review:

• Six vulnerable resolutions updated
• Frozen Bun 1.3.12 install, typecheck, lint, and build pass
• CI: 1,133 tests passed, one skipped; 82.48% line coverage
• Dependency audit and gitleaks pass
• Serious local review and targeted fix verification are clean
• Human review and merge

PR: #67
Blocked: none.
Next: Elberte reviews and merges; agent work stops here.

[ElbertePlinio]

Merged in #67.

• Six vulnerable dependency resolutions updated
• Full CI, coverage, dependency audit, and gitleaks passed
• Human review completed
• Squash-merged to main

This clears the inherited dependency-audit blocker for #65. No changes were made to #65 in this PR.