fix(deps): nodemailer 9 resolves 6 advisories

[goetchstone]

What

Upgrades nodemailer 7 → 9, which patches all 6 nodemailer advisories (one high) that #72 had to allowlist. The scripts/audit-check.mjs allowlist shrinks to postcss only.

Why the overrides

@auth/core declares an optional nodemailer@^7 peer — only for next-auth's Email (magic-link) provider. We use the Credentials provider exclusively (server/auth/index.ts), so next-auth never loads nodemailer. A package.json overrides forces the whole tree to nodemailer 9, which:

• resolves npm ci cleanly (override warnings only, no ERESOLVE failure), without --legacy-peer-deps;
• is runtime-safe — the overridden code path is never executed.

@types/nodemailer bumped 7 → 8 (latest; covers our createTransport/sendMail/verify usage).

Verified (node:20 container)

• npm ci — clean (override warnings only)
• tsc --noEmit — clean
• vitest — 49 passed
• npm audit --omit=dev — no nodemailer advisories (only postcss moderate remains)
• npm run build — exit 0

Supersedes Dependabot #73 (which failed npm ci on the peer-dep). Documented in CLAUDE.md + docs/DECISIONS.md.

🤖 Generated with Claude Code