chore(web): fix npm audit — undici HIGH + bits-ui chain (7 vulns) #365

Summary

Fix failing npm Audit CI check: undici 7.0.0–7.30.0 HIGH (GHSA-4qv8-2p9j-2685, GHSA-f72v-6w45-q472, GHSA-xjj6-f33q-929c — fix available via npm audit fix) + 6 low in bits-ui/runed/svelte-toolbelt chain. 7 vulnerabilities (6 low, 1 high).

Why

Fresh advisory appeared 2026-10-26; hits develop and all open PRs retroactively (PR #364 red, no web/ changes involved). Same class as #358/#359 dependency-audit fixes.

Acceptance criteria

• npm audit --audit-level=moderate clean (or documented override with rationale) in web/
• npm run check && npm run build && npm test green
• Minimal diff: package.json/package-lock.json only