Fix TokenBucket timing test and resolve minimatch ReDoS vulnerability

- Set refillRate=0 in consume test for deterministic assertions (fixes CI flake)
- npm audit fix: upgrade minimatch to resolve high-severity ReDoS (GHSA-7r86-cg39-jmmj)
- All 482 tests pass, 0 vulnerabilities

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: Ascendral