fix: resolve dependency and CodeQL follow-up alerts

[KDB-Wind]

What changed

• upgrade React Router and syntax highlighting dependencies to remove the four open Medium Dependabot advisories
• make four distributed-lock release paths unconditional after successful acquisition
• harden four nullable input/configuration paths and add mapping regression tests
• update governance evidence with the paginated post-PR fix: close remaining critical SSRF alerts #11 security snapshot

Why

The post-merge scan for PR #11 completed successfully, but a paginated API check still showed 99 open CodeQL alerts and four Medium Dependabot alerts. A successful scanning job does not mean alerts are closed. This PR handles the directly actionable dependency, lock-release, and null-dereference findings without bulk-dismissing alerts.

Validation

• ./mvnw -B -ntp verify
• targeted LightRAG, mapping, memory-lock, schedule, and tier-validator tests
• npm run build
• npm run test (18 passed)
• npm run lint
• npm audit --audit-level=moderate (0 vulnerabilities)

Review notes

This remains a Draft until GitHub Dependency Review and CodeQL show the resulting alert state. The two LightRAG SSRF alerts are intentionally not dismissed in this PR; their trust-boundary disposition must be supported by the PR scan or a separate documented decision.