Resolve 9 open security alerts: 8 Dependabot dependency vulnerabilities + 1 CodeQL clear-text logging

[TFT444]

Summary

9 open security alerts across Dependabot (8) and CodeQL code scanning (1). Tracking all of them here to fix together.

Dependabot alerts (8 open)

Alert #	Package	Severity	Issue	Fixed in
#12	react-router (root)	High	RSC Mode CSRF bypass allows action execution before 400 response	8.3.0
#10	react-router (frontend)	High	RSC Mode CSRF bypass allows action execution before 400 response	8.3.0
#8	react-router (frontend)	High	Unauthenticated DoS via inefficient route matching	7.18.0
#9	postcss (frontend)	High	Path traversal via source map auto-loading - arbitrary .map file disclosure	8.5.18
#7	react-router (frontend)	Medium	Open redirect via backslash in <Link>/useNavigate	7.18.0
#6	react-router (frontend)	Medium	Missing protocol validation in RSCErrorHandler (XSS)	7.18.0
#5	react-router (frontend)	Medium	Arbitrary constructor injection via deserializeErrors() in SSR hydration	7.18.0
#4	brace-expansion (frontend)	High	DoS via exponential-time expansion of consecutive non-expanding {} groups	5.0.7

Bumping react-router to >=8.3.0 covers all 5 react-router alerts at once (8.3.0 supersedes the 7.18.0 fix). postcss needs >=8.5.18, brace-expansion needs >=5.0.7. Affects frontend/package-lock.json and package-lock.json (root).

CodeQL code scanning (1 open)

Alert #31 - scanner/rules/az_idn_006.py: py/clear-text-logging-sensitive-data (High) - "Clear-text logging of sensitive information."

This matches SEC-011 from the July 13 security assessment, which was reportedly addressed by PR #184 (issue #178). Needs verification: either that fix never actually reached dev, or this is a regression/re-introduction. Check current logging in az_idn_006.py against what #184 changed before re-fixing.

Acceptance criteria

• react-router bumped to >=8.3.0 in both package-lock.json and frontend/package-lock.json
• postcss bumped to >=8.5.18
• brace-expansion bumped to >=5.0.7
• All 8 Dependabot alerts show as resolved
• az_idn_006.py's clear-text logging issue investigated and fixed (or confirmed already-fixed and alert re-triggered by something else)
• CodeQL alert [DOCS] Update architecture.md to reflect all 20 current rules #31 resolved
• npm audit / pip-audit clean, ruff/pytest green