chore(deps): npm audit fix

[github-actions]

Automated dependency fixes produced by npm audit fix --omit=dev.

Security Summary (npm audit --omit=dev)

• Before fix: critical=0, high=2, moderate=1, low=0, info=0 (npm exit code 1; expected when vulnerabilities are present)
• After fix: critical=0, high=0, moderate=0, low=0, info=0

Top findings before fix (prod dependencies only):

• [high] ip-address: ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass (GHSA-mwp4-54f8-5fhr)
• [high] ip-address: ip-address: a CIDR suffix on the parsed address suppresses special-use classification and can bypass SSRF and trust-boundary checks (GHSA-4xrf-jv44-h6hh)
• [high] ip-address: ip-address: misclassification of IPv4-mapped/NAT64 IPv6 addresses can bypass SSRF and trust-boundary checks (GHSA-22jq-vg5j-6vgg)
• [high] nanoid: nanoid: custom generators can loop indefinitely when size is zero (GHSA-2v37-7h3g-55p8)
• [moderate] sanitize-html: sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes (GHSA-vccv-cmxp-4j9h)

Full audit JSON reports are attached as workflow artifacts (audit-before.json, audit-after.json).
Please review lockfile changes and run CI/tests before merging.