fix(deps): resolve open high-severity Dependabot advisories (#1919)

* fix(deps): resolve open high-severity Dependabot advisories

Patch all fixable open high-severity Dependabot alerts.

Backend (go.mod):
- google.golang.org/grpc 1.82.0 -> 1.82.1 (GHSA-hrxh-6v49-42gf)

Frontend (pnpm overrides in apps/package.json) — all transitive:
- postcss -> ^8.5.12 (GHSA-6g55-p6wh-862q)
- fast-uri -> ^3.1.4 (GHSA-v2hh-gcrm-f6hx / -v39h / -q3j6 / -4c8g)
- sharp -> ^0.35.0 (GHSA-f88m-g3jw-g9cj)
- linkify-it -> ^5.0.2 (GHSA-v245-v573-v5vm / -22p9)
- js-yaml@4 -> ^4.3.0 (GHSA-52cp-r559-cp3m)
- adm-zip -> ^0.6.0 (GHSA-xcpc-8h2w-3j85)
- hono -> ^4.12.25 (GHSA-88fw / -q5qw / -3vhc / -f67f)
- @hono/node-server -> ^1.19.10 (GHSA-wc8c-qw6v-h7f6)
- ws -> ^8.21.0 (GHSA-96hv-2xvq-fx4p)
- lodash / lodash-es -> ^4.18.0 (GHSA-r5fr-rjxr-66jc)
- flatted -> ^3.4.2 (GHSA-rf6f / -25h7)
- @isaacs/brace-expansion -> ^5.0.1 (GHSA-7h2j-956f-4vf2)
- @modelcontextprotocol/sdk -> ^1.26.0 (GHSA-345p-7cg4-v4c7)
- brace-expansion@1 -> ^1.1.16, brace-expansion@2 -> ^2.1.2 (GHSA-3jxr)
- path-to-regexp@8 -> ^8.4.0 (GHSA-j3q9-mxjg-w52f)
- picomatch@2 -> ^2.3.2 (GHSA-c2c7-rcm5-vvqj)
- minimatch@3 -> ^3.1.4, @9 -> ^9.0.7, @10 -> ^10.2.3
  (GHSA-7r86 / -23c5 / -3ppc)

Major-scoped override keys preserve each in-tree major line rather than
force a single version across incompatible consumers.

Not fixable here: github.com/docker/docker alerts (GHSA-x744-4wpc-v9h2,
GHSA-x86f-5xw2-fm2r, GHSA-rg2x-37c3-w2rh). No patched module version is
published — latest tag is v28.5.2+incompatible (the current pin) and two
of the three advisories have no fix yet.

Verified: backend build + vet clean; CLI 280 tests pass; web typecheck,
vite build, lint, and 6388 unit tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(web): regenerate license manifest after dependency bumps

---------

Co-authored-by: Kandev Agent <agent@kandev.dev>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/backend/go.mod

@@ -35,7 +35,7 @@ require (
 	golang.org/x/net v0.54.0
 	golang.org/x/sync v0.20.0
 	golang.org/x/sys v0.45.0
-	google.golang.org/grpc v1.82.0
+	google.golang.org/grpc v1.82.1
 	google.golang.org/protobuf v1.36.11
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	gopkg.in/yaml.v3 v3.0.1

apps/backend/go.sum

@@ -691,8 +691,8 @@ google.golang.org/grpc v1.31.1/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
 google.golang.org/grpc v1.34.0/go.mod h1:WotjhfgOW/POjDeRt8vscBtXq+2VjORFy659qA51WJ8=
 google.golang.org/grpc v1.35.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.82.0 h1:vguDnZUPjE26w09A63VoxZPnvPjB5Riyc0mkXPFmAIU=
-google.golang.org/grpc v1.82.0/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=

apps/package.json

@@ -26,7 +26,28 @@
   "pnpm": {
     "overrides": {
       "@codemirror/state": "6.5.3",
-      "@codemirror/view": "6.39.10"
+      "@codemirror/view": "6.39.10",
+      "postcss": "^8.5.12",
+      "fast-uri": "^3.1.4",
+      "sharp": "^0.35.0",
+      "linkify-it": "^5.0.2",
+      "js-yaml@4": "^4.3.0",
+      "adm-zip": "^0.6.0",
+      "hono": "^4.12.25",
+      "@hono/node-server": "^1.19.10",
+      "ws": "^8.21.0",
+      "lodash": "^4.18.0",
+      "lodash-es": "^4.18.0",
+      "flatted": "^3.4.2",
+      "@isaacs/brace-expansion": "^5.0.1",
+      "@modelcontextprotocol/sdk": "^1.26.0",
+      "brace-expansion@1": "^1.1.16",
+      "brace-expansion@2": "^2.1.2",
+      "path-to-regexp@8": "^8.4.0",
+      "picomatch@2": "^2.3.2",
+      "minimatch@3": "^3.1.4",
+      "minimatch@9": "^9.0.7",
+      "minimatch@10": "^10.2.3"
     },
     "onlyBuiltDependencies": [
       "esbuild",