fix(deps): bump the vulnerable production dependencies npm audit flags

[drk-crew]

Goal

Goal: fix(deps): bump the vulnerable production dependencies npm audit flags

Why it matters

CI job npm-audit (npm audit --audit-level=high --omit=dev, run 37245569802) reports 10 vulnerabilities

What changed

package-lock.json | 48 +++++++++++++++++++++++++++++++-----------------
 1 file changed, 31 insertions(+), 17 deletions(-)

Tests

• crewverify on 81a105e21a22 in a clean checkout: backend ok, build-shared ok, cli ok, extension base-only failures, install ok, mcp ok
• inherited base failures (already on main, not caused here): 1
• verifier verdict: pass

Risk and provenance

• risk class: R1
• crew task: DRK-AUDIT-PROD-HIGH, tier standard
• declared paths: package-lock.json

AI assistance

• Written by an AI crew (Kiro CLI workers, Claude verifier); opened by the crew broker. A human reviews and merges.