Non-blocking review findings from PR #144 (1)

[twistedmelonman]

Non-blocking concerns raised while reviewing PR #144 (chore: re-triage the audit baseline, add npm to dependabot).

None of these blocked the merge. They are batched into one issue so a
review's findings stay one unit of attention rather than 1 separate
tracking issues; tick items off as they are addressed, and close this issue
when the list is done or the remaining items are judged not worth doing.

• Vendored Astro image-size copy is invisible to the audit baseline and guarded only by configuration (PR author, documented in docs/SECURITY-AUDIT.md (re-triage section), docs/SECURITY-AUDIT.md — section "Astro vendors its own image-size, invisible to this baseline")
  The PR itself documents that node_modules/astro/dist/assets/utils/vendor/image-size/ ships in the deployed SSR bundle, is not visible to npm audit, is not covered by the overrides block, and will never be reported by check-audit-baseline.sh. The author states it is not exploitable today because two guards fail closed: no image: block in astro.config.mjs (so isRemoteAllowed rejects every remote URL), and the configured @astrojs/netlify/image-service.js exports no transform method (so /_image throws first). Both guards are configuration rather than code, so adding an image.domains entry or switching image services would remove them. Worth tracking as a standing re-check trigger tied to any change to Astro image configuration; consider a lint or CI guard that fails if an image: block or alternate image service is introduced without revisiting this section.