fix(security): Patch 15 vulnerabilities in api-server

[git-steer]

Security Fix

This PR addresses 15 security vulnerabilities (non-destructive lockfile bumps).

CVE	Package	Severity	Fix Version
CVE-2026-48779	ws	HIGH	8.21.0
CVE-2026-54285	@opentelemetry/core	MEDIUM	2.8.0
CVE-2026-8723	qs	MEDIUM	6.15.2
CVE-2026-45736	ws	MEDIUM	8.20.1
CVE-2026-42338	ip-address	MEDIUM	10.1.1
CVE-2026-4800	lodash	HIGH	4.18.0
CVE-2026-2950	lodash	MEDIUM	4.18.0
CVE-2026-4867	path-to-regexp	HIGH	0.1.13
CVE-2026-33672	picomatch	MEDIUM	2.3.2
CVE-2026-33671	picomatch	HIGH	2.3.2
CVE-2026-30827	express-rate-limit	HIGH	8.2.2
CVE-2026-27903	minimatch	HIGH	3.1.3
CVE-2026-2391	qs	LOW	6.14.2
CVE-2025-13465	lodash	MEDIUM	4.17.23
CVE-2025-15284	qs	MEDIUM	6.14.1

• Critical: 0 High: 6 Medium: 8 Low: 1

---

Merge is gated by the ADR-005 functional-integrity gate. Generated by git-steer.

[git-steer]

🚦 Functional-integrity gate: NO-GO (ADR-005) — auto-merge withheld, held for human review.

Dimensions: [{"dimension":"BUILD","result":"PASS"},{"dimension":"TEST","result":"FAIL"},{"dimension":"SMOKE","result":"FAIL"},{"dimension":"SURFACE","result":"NOT_APPLICABLE"}]

Why this is held — gate verdict NO-GO:

api-server (npm) — TEST FAILED

Error: Cannot find module '/home/runner/work/git-steer/git-steer/target/api-server/test/server.test.js'
    at Function._resolveFilename (node:internal/modules/cjs/loader:1430:15)
    at defaultResolveImpl (node:internal/modules/cjs/loader:1040:19)
    at resolveForCJSWithHooks (node:internal/modules/cjs/loader:1045:22)
    at Function._load (node:internal/modules/cjs/loader:1216:25)
    at wrapModuleLoad (node:internal/modules/cjs/loader:254:19)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:171:5)
    at node:internal/main/run_main_module:36:49 {
  code: 'MODULE_NOT_FOUND',
  requireStack: []
}
Node.js v22.23.0
> commit-relay-dashboard@1.0.0 test
> node test/server.test.js

api-server (npm) — SMOKE FAILED

    at Module._compile (node:internal/modules/cjs/loader:1781:14)
    at Object..js (node:internal/modules/cjs/loader:1913:10) {
  code: 'MODULE_NOT_FOUND',
  requireStack: [
    '/home/runner/work/git-steer/git-steer/target/lib/orchestration/workflow-engine.js',
    '/home/runner/work/git-steer/git-steer/target/api-server/server/routes/workflows.js',
    '/home/runner/work/git-steer/git-steer/target/api-server/server/index.js',
    '/home/runner/work/git-steer/git-steer/target/api-server/[eval]'
  ]
}
Node.js v22.23.0
[dotenv@17.2.3] injecting env (0) from .env -- tip: ⚙️  override existing env vars with { override: true }
[APM] Elastic APM is disabled (ELASTIC_APM_ENABLED=false)
[dotenv@17.2.3] injecting env (0) from .env -- tip: 🔐 encrypt with Dotenvx: https://dotenvx.com

[git-steer]

🚦 Functional-integrity gate: NO-GO (ADR-005) — auto-merge withheld, held for human review.

Dimensions: [{"dimension":"BUILD","result":"PASS"},{"dimension":"TEST","result":"FAIL"},{"dimension":"SMOKE","result":"FAIL"},{"dimension":"SURFACE","result":"NOT_APPLICABLE"}]

Why this is held — gate verdict NO-GO:

api-server (npm) — TEST FAILED

Error: Cannot find module '/home/runner/work/git-steer/git-steer/target/api-server/test/server.test.js'
    at Function._resolveFilename (node:internal/modules/cjs/loader:1430:15)
    at defaultResolveImpl (node:internal/modules/cjs/loader:1040:19)
    at resolveForCJSWithHooks (node:internal/modules/cjs/loader:1045:22)
    at Function._load (node:internal/modules/cjs/loader:1216:25)
    at wrapModuleLoad (node:internal/modules/cjs/loader:254:19)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:171:5)
    at node:internal/main/run_main_module:36:49 {
  code: 'MODULE_NOT_FOUND',
  requireStack: []
}
Node.js v22.23.0
> commit-relay-dashboard@1.0.0 test
> node test/server.test.js

api-server (npm) — SMOKE FAILED

    at Module._compile (node:internal/modules/cjs/loader:1781:14)
    at Object..js (node:internal/modules/cjs/loader:1913:10) {
  code: 'MODULE_NOT_FOUND',
  requireStack: [
    '/home/runner/work/git-steer/git-steer/target/lib/orchestration/workflow-engine.js',
    '/home/runner/work/git-steer/git-steer/target/api-server/server/routes/workflows.js',
    '/home/runner/work/git-steer/git-steer/target/api-server/server/index.js',
    '/home/runner/work/git-steer/git-steer/target/api-server/[eval]'
  ]
}
Node.js v22.23.0
[dotenv@17.2.3] injecting env (0) from .env -- tip: 📡 add observability to secrets: https://dotenvx.com/ops
[APM] Elastic APM is disabled (ELASTIC_APM_ENABLED=false)
[dotenv@17.2.3] injecting env (0) from .env -- tip: 🔐 encrypt with Dotenvx: https://dotenvx.com