chore(frontend): apply npm audit fix for devDependencies (lot A)

[Vhivi]

Objective

Apply a non-breaking frontend devDependencies security maintenance batch (Lot A), limited to lockfile-level transitive updates.

Breaking Change Notice

No intended functional/API/runtime breaking change.
This PR does not introduce major tooling migrations.

Scope

• Frontend only
• npm audit fix (non-breaking)
• Lockfile refresh only (frontend/package-lock.json)
• No backend changes
• No direct package.json dependency bumps in this lot

Validation

• npm audit
• npm test -- --runInBand
• npm run build

Results

• Audit findings reduced from 27 to 19
• Frontend tests passed (2/2 suites, 7/7 tests)
• Production build passed

Remaining Risks / Follow-up

Remaining vulnerabilities are tied to legacy Vue CLI tooling and Jest/jsdom upgrade paths requiring breaking changes.
A dedicated migration/security continuation branch will handle:

• Vue CLI maintenance-mode constraints
• potential migration to modern tooling (Vite path)