[byteful]

What changed

Backend CI's production dependency audit started failing on every PR after new advisories were published. The fix moves the mail library to its patched major and pins patched versions of the affected transitive packages. It also records one documented exception: a certificate library the iOS push sender only uses to read our own credential files, which has no patched release. No user-facing behavior changes.

Before you start

• Where: this PR's CI, then staging (civfix.dev) after it merges to main
• Sign in as: your own email address (so the sign-in code email really sends)
• Related PRs: unblocks PostGIS test image override for arm64 #130 and Deploy jobs use GitHub environments #131

Verify

1. Look at this PR's checks — Expect: "lint / typecheck / build / test", "integration (postgis + redis)" and "media-worker image sandbox smoke" pass.
2. After merge, open civfix.dev, tap "Sign in", then "Continue with email", enter your email and tap "Send me a code" — Expect: "Check your inbox", and the code email arrives within a minute.
3. Enter the code — Expect: you are signed in.

Regression

Push notifications on iOS — [Mobile]

1. In the staging TestFlight build, signed in, have a second account comment on one of your reports — Expect: the push notification arrives as before.

Not covered

• Inbound mail parsing and admin outbound mail are covered by unit tests only; the sign-in email above exercises the same mail library.