fix: resolve npm audit advisories

New advisories published against unchanged pins; package.json is untouched.
Lockfile only, no --force, so no breaking downgrades.

Author: jakewrfoster