Harden SEO preview for portfolio release

[alianjum0]

Summary

• update Axios, Cheerio, and Express and standardize pnpm
• block SSRF through URL, IP, DNS, and redirect validation
• escape remote metadata and sanitize preview URLs
• add request limits, safe errors, Helmet headers, CSP, and rate limiting
• add 15 automated tests, Node 20/22 CI, and portfolio documentation

Validation

• pnpm test: 15 passed
• frozen pnpm install passed
• production dependency audit: no known vulnerabilities
• direct dependencies: current
• Node syntax checks passed
• public URL integration smoke test passed against example.com

Review notes

• proxy trust defaults off and can be configured with TRUST_PROXY_HOPS
• no deployment or merge is included in this PR