chore(deps): resolve all open npm audit high/moderate advisories so CI audit is green

[thewrz]

This was written agentically; verify its assertions:

Why

main currently fails its own CI audit job (npm audit --audit-level=high). Every open dependabot/renovate PR inherits that red check, and branch protection requires audit green plus an up-to-date branch, so no single bot PR can land on its own.

Open advisories on main (server/):

Package	Severity	Path	Fix
fast-uri	high	fastify → fast-uri (prod)	lockfile refresh (GHSA-5jgf-p345-68v8, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf, GHSA-jqff-g426-hqxp)
fastify ≤5.12.0	moderate	direct (prod)	fastify 5.12.1 (GHSA-w2qp-rph6-63g4, GHSA-3m5p-2c4r-xxw2)
js-yaml 4.0.0–4.3.1	high	dev transitive	lockfile refresh
nanoid <3.3.18	high	vitest → vite → postcss → nanoid	lockfile refresh
@vitest/mocker ≤4.1.10	moderate	vitest (dev)	vitest 4.1.11
extract-zip	high	puppeteer 24 → @puppeteer/browsers 2.13 (dev)	puppeteer 25.x (drops extract-zip)

What

One consolidated PR that lands all of the above so audit goes green, superseding the per-package bot PRs (#146, #147, #148, #149, #150, #151, #136) which are closed as superseded.

🤖 Co-authored by Claude Fable 5.1.