fix: resolve remaining Dependabot and CodeQL alerts

[marceloceccon]

Summary

• Patch remaining open Dependabot alerts.
• Parse provider API hosts instead of substring-matching URLs.

Test plan

• tests (256 passed)
• lint
• format check
• production build

Details:

• Direct: next ^15.5.21 (lockfile 15.5.24), postcss 8.5.23
• Transitive overrides: nanoid 3.3.18, js-yaml 4.3.1, undici 7.29.0, sharp 0.35.4, vite 8.0.16, brace-expansion 1.1.16 and 5.0.7, Babel core 7.29.6
• providers.ts now uses URL hostname checks so query/path embeddings of anthropic.com cannot select Anthropic auth headers