build(deps): roll up legacy npm security updates

[openai0229]

Related issue

Refs #2231

Summary

Rolls the 16 legacy npm security pull requests into one reviewable lockfile update after Dependabot's grouped security refresh failed inside its updater.

The rollup is based on current main and combines the exact Dependabot head commits from #1884, #1961, #1962, #1986, #1988, #1990, #1991, #1994, #1995, #2005, #2011, #2012, #2026, #2027, #2028, and #2077.

Covered targets: shell-quote 1.10.0, fast-uri 3.1.4, svgo 2.8.3, piscina 4.9.3, form-data 4.0.6, protocol-buffers-schema 3.6.1, lodash-es 4.18.1, js-cookie 3.0.8, follow-redirects 1.16.0, flatted 3.4.3, pbkdf2 3.1.6, mdast-util-to-hast 13.2.1, @babel/helpers 7.29.7, sha.js 2.4.12, min-document 2.19.2, and postcss 8.5.23.

Affected surfaces

• Frontend / Web
• Backend / API / Storage
• Database plugin / Driver
• JCEF / Desktop packaging
• CI / Build / Release
• Documentation only

Verification

• Commands and results:
  • git diff --check origin/main...HEAD: passed.
  • Target-version readback from chat2db-community-client/yarn.lock: all 16 target versions present.
  • yarn install --frozen-lockfile --ignore-scripts --non-interactive with Yarn 1.22.22: passed without changing the lockfile; existing peer-dependency warnings remain.
• Manual verification: Compared the rollup source against the 16 closed Dependabot PR head commits. One overlapping to-buffer selector retained the union of compatible ranges while resolving to 1.2.2.
• UI evidence: N/A

Risk and compatibility

• Public API or stored data: No intentional API or stored-data change; this updates transitive frontend packages in the lockfile.
• Database or driver compatibility: N/A; no backend dependency changes.
• Network, privacy, or security: Applies the security versions proposed by the source Dependabot PRs. Review and CI are still required before merge.
• Community / Local / Pro boundary: Community frontend only.
• Backward compatibility: No package manifest constraints changed; lockfile-resolved dependency behavior may change at the listed package boundaries.

Reviewer map

• Start here: chat2db-community-client/yarn.lock, then compare the listed source PR heads.
• Failure condition: Frozen install rewrites the lockfile, frontend CI fails, or any listed security target is absent.
• Rollback or disable path: Revert this PR; the grouped Dependabot configuration from ci(dependabot): group related dependency updates #2208 remains enabled for future updates.

Contributor declaration

• I linked the Issue that defines this change.
• I tested the affected behavior and reported the actual results above.
• I did not include credentials, private data, or generated build output.
• I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: Codex combined the existing Dependabot commits, resolved the overlapping Yarn selector, verified target versions, and ran the frozen-lockfile validation.

[openai0229]

Closing this manual Dependabot security rollup together with the current dependency update backlog to reduce review noise. No dependency changes from this PR were merged.