fix: address nspect package findings

[johnnygreco]

Summary

• override the vulnerable transitive fflate 0.6.10 with 0.8.3
• require Tornado 6.5.8 and refresh the Reachy lockfile
• retain GStreamer 1.28.6 because the recommended 1.29.2a0 bundle is not resolvable on supported macOS/Python environments: gstreamer-python 1.29.2a0 has no compatible macOS wheel

Validation

• npm audit --omit=dev
• npm ls fflate --all
• npm run build
• npm run verify:visual
• uv lock --check
• frozen uv export confirms tornado==6.5.8
• Ruff manifest check
• git diff --check

Environment limitations

• Reachy full lint, type, and pytest checks require the macOS-only locked environment and cannot run on this Linux host.
• Cargo tests were attempted but this host does not provide CMake; the changed robotics dependency is limited to the web application.