v1.1.6 — security dependency updates (UI)

Security update for the codeforge-ui image. All open advisories in web/ are fixed (#55); npm audit reports 0 vulnerabilities.

Runtime dependencies of the UI server (Express + proxy) that were vulnerable:

• proxy-addr 2.0.7 → 2.0.8 (critical)
• body-parser 2.3.0 → 2.4.0 (GHSA-27r3-jxmh-p828, high)
• compression 1.8.1 → 1.8.2 (high)
• follow-redirects 1.16.0 → 1.16.1 (high, via http-proxy-middleware)

Build toolchain only: vite 8.3.5, source-map-js 1.2.2, brace-expansion 1.1.21 / 2.1.7.

No changes to the Go server or the codeforge / codeforge-action images beyond the rebuild. Upgrading from v1.1.5 is a drop-in image bump.