chore(deps): automated bump for main

[ericfitz-deps-bot]

Automated dependency bump for main (safe patch/minor only).

Generated by the deps:bump skill running headless in CI. Review before merging.

Skill output / manual-review plan

## Summary

Ran the bump skill on the current branch (`deps/auto-bump/main/30924044554`) only, Node/pnpm ecosystem (the sole active ecosystem — Python deps in `pyproject.toml` are unpinned dev-script deps with no lockfile, nothing to bump; no Go). One commit created: `29c3efab`.

**Applied (all safe, no bisection needed — build/test/lint passed on the first try):**
- 3 security fixes via `pnpm.overrides` floor bumps: `fast-uri`, `hono`, `brace-expansion` — all transitive, pulled in through `@angular-eslint`/`@angular/cli`/`@analogjs` dev tooling. `pnpm audit` went from 1 moderate + 2 high → 0.
- 12 direct patch/minor updates (typescript-eslint trio, dompurify, express-rate-limit, globals, marked, mermaid, survey-core/survey-angular-ui, tsx, @oxc-project/runtime).
- Verified: `pnpm run build` ✅, `pnpm test` ✅ (6002/6002), `pnpm run lint`/`lint:e2e`/`lint:scss` ✅. `lint:i18n` failed only because the `uv` binary isn't installed in this CI environment — pre-existing environment gap, unrelated to the Node bump, not a reason to hold the commit.

**Manual-review plan (not auto-applied):**

| Priority | Package | Current → Latest | Reason |
|---|---|---|---|
| 1 | `typescript` | `~6.0.3` → `7.0.2` | Major version. No CVE driving it. Note: `openapi-typescript` already has an unmet-peer warning wanting `typescript@^5.x` even at 6.0.3, so this needs its own compatibility pass before touching. |

Everything else checked was already at `latest` (notably the whole `@angular/*` family, `@antv/x6`, `vite`, `zone.js`, `eslint`) — no coordinated-ecosystem update is currently pending.

No push, PR, issue filing, or security-review workflow was run — those are left to the separate CI step as instructed.