fix(deps): remediate high/moderate audit advisories (no breaking changes)

[EmeditWeb]

What & why

Security remediation of the in-range, non-breaking slice of the API's dependency advisories, delivered ahead of the larger framework migrations so the safe fixes land now.

Fixed — npm audit 20 → 8

• 7 high: axios, brace-expansion, browserslist, fast-uri, ip-address, multer, @nestjs/platform-express
• 4 moderate: hono, @hono/node-server, qs, baseline-browser-mapping
• 1 low: body-parser

Mechanism: targeted npm update of the in-range transitive advisories (patches each instance within its parent's accepted range — brace-expansion/fast-uri/js-yaml live at multiple majors), plus a multer floor bump ^2.1.1 → ^2.4.0 (advisory affects <=2.2.0) pinned with overrides: { "multer": "$multer" } so @nestjs/platform-express's nested copy dedupes to the patched 2.4.0. Deliberately not npm audit fix — that churns the @nestjs/platform-fastify plugin cluster and trips the @fastify/static v9↔v10 peer conflict.

Deferred — dedicated migration PRs (no safe in-range fix)

• fastify v5 cluster: fastify, @fastify/static (→v10), find-my-way, @nestjs/platform-fastify, @nestjs/swagger. The root still declares fastify ^4 while @nestjs/platform-fastify@11 bundles fastify 5 — a genuine v4→v5 migration.
• legacy stellar-sdk: stellar-sdk ^11 → @stellar/stellar-sdk (npm's only offered "fix" is a bogus downgrade to 0.2.1) plus its vulnerable toml dependency.
• js-yaml: the CVE fix ships only in the 5.x major and was not backported to the 3.x/4.x lines the tree uses (via @nestjs/swagger, eslint, istanbul). Reachable only through developer-controlled YAML (OpenAPI generation, lint/nyc config), not user input.

Test plan

• npm ci (strict, from the regenerated lock) — passes; lock ↔ manifest in sync
• npm run build (nest build) — passes
• npm test — 39 suites / 460 tests pass (incl. multer-backed upload paths and the auth/admin guards)
• Only package.json + package-lock.json changed
• CI green on this PR