fix(ci,#1035): clear production npm audit gate

[joelteply]

Summary

• Remove unused root sqlite3 and @types/sqlite3 dependencies; the codebase uses better-sqlite3 and has no root sqlite3 imports.
• Refresh production dependency resolutions under existing semver ranges to clear high/critical audit findings.
• Leave the remaining low, no-fix edge-tts-node transitive crypto-browserify/elliptic findings visible for follow-up replacement work.

Why

#1035 is blocked by npm audit --omit=dev --audit-level=high. The high/critical findings are independent of the Docker image freshness blocker and can be fixed on canary now.

Verification

• npm ci
• npm audit --omit=dev --audit-level=high
• git diff --check
• npm run build:ts
• precommit hook: TypeScript, browser ping, chat-roundtrip persona reply
• pre-push hook: TypeScript, ESLint ratchet; Rust/Docker skipped as not relevant

Notes

• chore: promote canary to main (79 commits, 17 install fixes from 2026-05-03) #1035 still needs Linux/amd64 scripts/push-current-arch.sh for stale :pr-1035 images before Carl install smoke can test the current canary bits.