fix(deps): bump brace-expansion override floors to patched versions

src/StackAlchemist.Web/audit-allowlist.json

@@ -9,13 +9,5 @@
     "This file is not a way to silence a fixable finding. If `npm audit` can",
     "resolve it with an override or an upgrade, do that instead."
   ],
-  "allow": [
-    {
-      "advisory": "GHSA-mh99-v99m-4gvg",
-      "package": "brace-expansion",
-      "scope": "dev",
-      "expires": "2026-10-31",
-      "reason": "DoS via unbounded expansion length. Patched only in brace-expansion 5.0.8 — the advisory covers the entire <=5.0.7 range, so the 1.x line has no fixed release at all. Our remaining exposure is minimatch@3.1.5, which pins brace-expansion ^1.1.7 and calls it as a bare function; brace-expansion 5 is a named-export module, so forcing it there breaks eslint at runtime. minimatch@3 reaches us only through eslint 9 and the eslint-config-next plugin set (eslint-plugin-import/jsx-a11y/react), whose latest releases still pin minimatch ^3.1.2 and cap their eslint peer at 9. `npm audit fix --force` 'resolves' this by downgrading eslint-config-next from ^16.2.10 to ^0.2.4, which is not a fix. Lint-time only, never shipped to users. Revisit when the eslint-config-next plugins move off minimatch 3."
-    }
-  ]
+  "allow": []
 }

src/StackAlchemist.Web/package.json

@@ -61,8 +61,8 @@
     "postcss": "^8.5.18",
     "ws": "^8.20.1",
     "sharp@0": "^0.35.0",
-    "brace-expansion@1": "^1.1.16",
-    "brace-expansion@2": "^2.1.2",
+    "brace-expansion@1": "^1.1.17",
+    "brace-expansion@2": "^2.1.3",
     "brace-expansion@5": "^5.0.8"
   }
 }