fix(ci): pin deepmerge-ts and stub hypermultimedia auth

Prisma still ships deepmerge-ts 7.1.5 (GHSA-ggr8-5vv4-36mx). The
override lifts it to 8.0.1 so the high audit gate stays closed.

The invalid-token upload test called live Auth. No-infra CI has
none, so requireUser returned 503. The same supabase stub as
documents.test.ts keeps that path at 401.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: HMarzban

apps/hocuspocus.server/tests/integration/hypermultimedia.test.ts

@@ -1,4 +1,31 @@
-import { describe, test, expect, beforeAll, beforeEach } from 'bun:test'
+import { describe, test, expect, beforeAll, beforeEach, mock } from 'bun:test'
+
+// Drive requireUser through the real auth module + a stubbed anon client.
+// Do NOT mock `lib/auth` itself — that sticky mock.module poisons later suites.
+mock.module('../../src/lib/supabase', () => ({
+  getAnonClient: () => ({
+    auth: {
+      getUser: async (token: string) => {
+        if (token === 'valid-test-token') {
+          return {
+            data: {
+              user: {
+                id: 'user-123',
+                email: 'owner@example.com',
+                is_anonymous: false,
+                user_metadata: {}
+              }
+            },
+            error: null
+          }
+        }
+        return { data: { user: null }, error: { status: 401, message: 'invalid' } }
+      }
+    }
+  }),
+  getServiceRoleClient: () => null
+}))
+
 import { Hono } from 'hono'
 import hypermultimediaRouter from '../../src/api/routers/hypermultimedia.router'
 import { TestServer, createMockPrisma, createMockRedis } from '../helpers/test-server'

bun.lock

@@ -39,7 +39,8 @@
     "@babel/plugin-transform-modules-systemjs": "^7.29.7",
     "undici": "^7.29.0",
     "uuid": "^11.1.1",
-    "nanoid": "^3.3.17"
+    "nanoid": "^3.3.17",
+    "deepmerge-ts": "8.0.1"
   },
   "prettier": "./.prettierrc.json",
   "scripts": {