Apply npm audit fixes to all lockfile-managed dependencies

[Copilot]

This PR applies npm audit fix across every directory containing an npm lockfile, without using force flags or overrides. In this repository, only the root lockfile was in scope, so the update is isolated to dependency resolution in package-lock.json.

• Scope

  • Detected lockfiles in:
    • package-lock.json (repo root)
  • No additional package manager lockfiles were present.

• Dependency resolution updates

  • Refreshed vulnerable transitive packages in package-lock.json.
  • Key security-related updates include @xmldom/xmldom via transitive dependency upgrades (e.g., svg2ttf chain).
  • No source files or package manifests were modified.

• Resulting lockfile delta

  • Updated resolved versions/integrity hashes for affected transitive deps.
  • Maintains existing dependency graph shape while removing known vulnerable selections.

# applied in each lockfile directory (root only in this repo)
npm audit fix

Original prompt

Run npm audit fix in all directories with lockfiles. No force flags. No overrides. Create a PR.

Created from VS Code.