fix(deps): patch critical and high dependency vulnerabilities

[Star-Lotus]

Summary

Patches 156 Dependabot alerts (2 critical, 67 high priority) by upgrading vulnerable npm packages in the frontend.

Critical (fixed)

• vitest: 3.2.4 → 3.2.7

High (fixed)

• axios: 1.13.6 → 1.19.0
• vite: 7.3.1 → 7.3.5
• js-yaml: 4.1.1 → 4.3.1
• brace-expansion: 2.0.2 → 2.1.4, 1.1.12 → 1.1.18
• ws: 8.19.0 → 8.21.3
• flatted: 3.3.3 → 3.4.4
• glob: 10.3.10 → 10.5.0 (via npm overrides)

Medium (fixed)

• postcss: 8.5.6 → 8.5.26
• nanoid: 3.3.11 → 3.3.18
• next-intl: 4.9.1 → 4.13.5
• follow-redirects: → 1.16.0
• form-data: → 4.0.6
• picomatch: → 4.0.4

Skipped (with reason)

Package	Reason
next (14→15)	Major version breaking upgrade; all next alerts require 15.x
esbuild (0.27→0.28)	Pinned by vite ^0.27.0; low severity
uuid (9→11)	Major version; locked by @react-three/drei
@tiptap/*	Script editor core; version locked per policy
glib (rust)	Tauri/Cargo ecosystem; separate upgrade track
postcss@8.4.31 (nested in next)	Embedded in next package; requires next 15

Verification

• npm run typecheck ✓
• npm run test — 124 tests passed ✓
• npm run build ✓
• pytest -q — 208 passed, 1 skipped ✓

Technique

• Used npm update for semver-compatible upgrades
• Added overrides in package.json for glob (pinned by @next/eslint-plugin-next)
• Added vite as explicit devDependency to override vitest's transitive version

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}