chore(deps): bump qs, path-to-regexp, follow-redirects to patched versions

[NetworkTheoryAppliedResearchInstitute]

Patches three transitive dependency vulnerabilities flagged by Dependabot, via npm overrides in backend/package.json:

• qs -> 6.15.2 — CVE-2025-15284 (arrayLimit bracket-notation DoS; fix is >= 6.14.1)
• path-to-regexp -> 0.1.13 — CVE-2026-4867 (ReDoS via multiple route params)
• follow-redirects -> 1.16.0 — CVE-2026-40895 (custom auth-header leak on cross-domain redirect)

On the lockfile diff size: main's package-lock.json recorded only 96 of ~505 resolved packages, so npm install regenerated a complete lockfile. Among packages present in both lockfiles, exactly five versions changed: the three CVE fixes above, plus two incidental in-range transitive bumps the heal pulled in — jwa 1.4.1->1.4.2 and semver 7.7.1->7.8.1. No direct dependency versions changed and nothing moved to a new major.

Tests: 5/6 pass. The one failure (POST /listings creates service listing with limited media) is pre-existing and unrelated — the test references app.routes, which does not exist in Express 4 (routes live on app._router.stack). Worth a separate fix.

Touches only backend/package.json and backend/package-lock.json.

[NetworkTheoryAppliedResearchInstitute]

Superseded: path-to-regexp (0.1.13) and follow-redirects (1.16.0) are already patched on main with 0 open alerts. The one package still alerting here is qs (6.15.3, 2 alerts), which #156 bumps to 6.16.0. Closing in favour of #156.