chore(deps): take the js-yaml denial of service out of the toolchain

[haribo]

Summary

npm audit --audit-level=high reported two high-severity findings — this time a real advisory, not the unreachable service of #80:

high  js-yaml — maxTotalMergeKeys does not limit CPU use for empty merge sources
      GHSA-2883-xcg3-v3hh
      reached through @redocly/openapi-core, which openapi-typescript depends on

Published after the last green run: nothing in the repository changed. It surfaced on #93, which touches no dependency at all.

What it is worth, said plainly

A development dependency only. openapi-typescript generates the frontend's types from our own openapi.json and never reaches a merchant's installation. The attack is a denial of service through crafted YAML, and the only YAML this toolchain reads is the contract this repository produces.

Fixed anyway, and quickly, because a gate that stays red teaches everyone to ignore it — which costs more than the advisory ever could.

Blast radius, measured

• package-lock.json only. package.json is untouched, so no declared range moves.
• 2 packages changed, 14 lines added and 14 removed.
• npm audit --audit-level=high reports 0 vulnerabilities afterwards.

The one thing worth watching

The update touches the tool that generates our API types. If generation changed by a character, just api-check would say so:

api types: current

It does not. The same contract produces the same file.

Test plan

• just frontend-check — typecheck, lint, theme tokens, type scale
• just frontend-test — 190 tests in 24 files
• just frontend-build — gallery still absent from the built assets
• just api-check — generated types unchanged
• npm audit --audit-level=high — 0 vulnerabilities

Backend untouched, so backend-check, backend-test and cargo audit do not apply. No source file changed, so just e2e has nothing new to exercise — the frontend build and the type check are what a lockfile bump can break, and both are green.

Closes #94