chore(deps): bump qs to 6.16.0 to clear the CLI production audit

`npm audit --omit=dev --workspace maka-agent` reports one moderate advisory
against qs 6.15.3 (array-limit bypass via bracket-key comma parsing; DoS
via attacker-controlled isBuffer), pulled in through
@larksuiteoapi/node-sdk in @maka/runtime. The "Build CLI release candidate"
CI step fails on any vulnerability, so every PR on main is red until the
lockfile moves. `npm audit fix --omit=dev` resolves it to 6.16.0; the
production dependency notices are regenerated for the new version.

Generated-by: Claude Code
Claude-Session: https://claude.ai/code/session_014ajaRxC4jydavY9nYUFj5J

Author: Joob1n

apps/desktop/resources/licenses/npm/THIRD_PARTY_NOTICES.txt

@@ -12590,7 +12590,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ================================================================================
 
-Package: qs@6.15.3
+Package: qs@6.16.0
 Declared license: BSD-3-Clause
 Selected license: BSD-3-Clause
 Repository: https://github.com/ljharb/qs.git

package-lock.json

@@ -6483,7 +6483,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ================================================================================
 
-Package: qs@6.15.3
+Package: qs@6.16.0
 Declared license: BSD-3-Clause
 Selected license: BSD-3-Clause
 Repository: https://github.com/ljharb/qs.git