What kind of change does this PR introduce?

Bug fix — scope: dependencies (root package.json), email provider, dead frontend files. Remediation batch C4 from the security audit: remediate the 285 production vulnerabilities (5 critical, 101 high) via pnpm.overrides + targeted bumps + removal of zero-import dependencies. No app code changes except the nodemailer transport hardening and deletion of the dead Solana wallet providers.

Why was this change needed?

pnpm audit --prod reported 285 vulnerabilities (5 critical, 101 high). The five criticals: happy-dom VM-escape RCE (via @pigment-css/react), protobufjs arbitrary-code-execution, form-data unsafe boundary, shell-quote injection, tar DoS. Two direct deps (sharp, nodemailer) carried HIGHs that the declared semver ranges could never reach. The removal targets (@solana/*, @postiz/wallets, sweetalert2, @mantine/modals, viem) were verified zero-import by the audit.

Technical Details & Scope

• pnpm.overrides (9): tar ^7.5.19, form-data ^2.5.4, protobufjs ^7.5.5, shell-quote ^1.8.4, fast-uri ^3.1.6, hono ^4.12.34, immutable ^5.1.8, handlebars ^4.7.9, happy-dom ^20.0.0 (clears the VM-escape RCE without removing @pigment-css/react — which is transitively required by @neynar/react and kept).
• Bumps: sharp ^0.33.4 → ^0.35.0 (clears 4 libvips CVEs on the user-upload path), vitest 3.1.4 → 3.2.6 + @vitest/ui 1.6.0 → 3.2.6 + @vitest/coverage-v8 → 3.2.6 (clears GHSA-5xrq-8626-4rwp critical).
• Removals (audit-verified zero-import): sweetalert2 + @sweetalert2/theme-dark, @mantine/modals, @solana/wallet-adapter-react + -react-ui, @postiz/wallets, viem, @tailwindcss/vite (v4 unused); dead files wallet.provider.tsx + placeholder/wallet.ui.provider.tsx deleted (the only importers of the Solana chain).
• Nodemailer mitigation: disableFileAccess/disableUrlAccess added to the transport (GHSA-p6gq-j5cr-w38f — raw bypass). The major bump 7→9 is deferred pending email transport testing.
• Kept after verification: parse5 (used by strip.html.validation.ts, x.provider.ts), canvas + image-to-pdf (used by linkedin.provider.ts), @meronex/icons + @pigment-css/react (transitively required by polotno / @neynar/react — the audit's "zero direct imports" finding did not account for transitive bundler imports).

Verification & Testing

• All 9 overrides verified in pnpm-lock.yaml (resolved versions above patched thresholds — table in the audit doc).
• pnpm install → +150/−1085 packages; peer warnings are pre-existing majors (eslint 8→9, prettier 2→3, tsup/swc chains) deferred as separate migrations.
• Full build passes: next build (frontend, Turbopack), nest build (backend + orchestrator) on Node 22.
• Nodemailer transport hardening: no raw usage anywhere; flags enforced at transport level.

QA

1. Run pnpm install — expect success with no ERR_PNPM_JSON_PARSE (all workspace package.json valid).
2. Verify overrides in the lockfile: findstr /C:"tar@7." /C:"form-data@2.5" /C:"protobufjs@7." /C:"shell-quote@1." /C:"fast-uri@3." /C:"hono@4." /C:"immutable@5." /C:"handlebars@4." /C:"happy-dom@20." pnpm-lock.yaml — expect every resolved version at/above the patched thresholds.
3. Run pnpm list sharp vitest --depth 0 — expect sharp ≥0.35, vitest 3.2.6.
4. Run pnpm --filter ./apps/frontend run build and pnpm --filter ./apps/backend run build and pnpm --filter ./apps/orchestrator run build — expect all three to exit 0.
5. Run pnpm audit --prod (with NODE_OPTIONS=--max-old-space-size=8192) — expect the 5 previous criticals gone (happy-dom/tar/form-data/protobufjs/shell-quote) and vitest's gone; remaining high nodemailer@7 is mitigated (documented, major bump deferred).
6. Confirm apps/frontend/src/components/auth/providers/wallet.provider.tsx no longer exists and the login page renders without Solana (register page + Apple/Farcaster/Github/Google providers unchanged).
7. Send a test email via the nodemailer provider — expect normal delivery (disableFileAccess/disableUrlAccess only block file:// and http(s):// fetches inside email content, which the app never uses).

Checklist:

• My code follows the project's code style and architectural conventions.
• Local build passes (pnpm run build).
• Branding guard validation passes (pnpm dlx tsx scripts/branding-guard.ts).
• Tests and typecheck have been verified without errors.
• Documentation has been updated (if applicable).
• No secrets or sensitive credentials are included in this PR.
• I have filled in the QA / Verification section above with real steps to verify this change.