fix(security): clear dependency advisories

[jason-allen-oneal]

Summary

• isolate patched Nodemailer 9.0.6 behind an application-only npm alias so NextAuth 4 does not impose its optional Nodemailer 7 peer range
• pin patched transitive versions for Babel, Ajv, flatted, minimatch, and picomatch
• remove the temporary production-audit exception

Verification

• npm ci
• npm ls --all --omit=optional
• npm audit: 0 vulnerabilities
• npm run audit:prod
• npm run lint
• npm run typecheck
• npm test: 20/20
• npm run test:integration against disposable MySQL 8.4: 1/1
• npm run build
• git diff --check

Supersedes the incompatible Nodemailer major PR #14 with a valid dependency graph.

[morrow-bluedot]

Independent exact-head review at dd9c419: lock integrity, full npm audit, production audit, lint, typecheck, 20 tests, and hosted build all pass. The app-only Nodemailer 9 alias is coherent with the unused optional NextAuth peer, and flatted is current at 3.4.4.