fix(web): bump brace-expansion to 5.0.12 for GHSA-mh99-v99m-4gvg

[uberware]

Resolves the high-severity brace-expansion DoS advisories flagged by npm audit:

• GHSA-mh99-v99m-4gvg — DoS via unbounded expansion length causing OOM
• GHSA-rgw5-rvv9-x895 — DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Dev-only and transitive: eslint@10.10.0 → minimatch@10.2.5 → brace-expansion. minimatch declares ^5.0.5, which the patched 5.0.12 satisfies, so this is a plain lockfile update — no overrides entry needed.

Lockfile diff is confined to that one package. It narrows its own engines from 18 || 20 || >=22 to 20 || >=22; irrelevant here, since .nvmrc is 24 and web/package.json requires node >=24.0.0.

Verified locally: format:check, typecheck, lint clean (lint matters most — this package backs eslint's glob matching), 90 test files / 1064 tests passing, and npm audit now reports 0 vulnerabilities.