chore(deps): consolidate dependency updates and security patches

[marcoscaceres]

Consolidates open dependabot PRs (#5298, #5299, #5300, #5301) and fixes 4 transitive security advisories.

closes #5298
closes #5299,
closes #5300
closes #5301

Direct deps:

• puppeteer 24.42.0 → 24.43.1 (minor, bug fixes + perf)
• rollup 4.60.2 → 4.60.3 (patch)
• vnu-jar 26.5.2 → 26.5.13 (patch — dependabot was offering stale 26.5.9)
• lint-staged 16.4.0 → 17.0.4 (major — only drops Node 20 support; we require Node ≥24)

Security fixes (all transitive, all resolved via update or pnpm override):

• basic-ftp 5.3.0 → 5.3.1 (high: client DoS via FTP)
• ip-address 10.1.0 → 10.2.0 (medium: XSS in Address6 HTML-emitting methods)
• fast-uri 3.1.0 → 3.1.2 (high: host confusion + path traversal)
• follow-redirects 1.15.6 → 1.16.0 (medium: auth header leak on cross-domain redirects)

Bundle: 421,901 → 423,576 bytes (+1.6KB). No license changes. No new transitive deps. All 1096 integration tests + 56 unit tests pass locally. ESLint 9 → 10 held for a separate PR due to breaking changes.