Fix high-severity dependency advisories

[ranade-oss]

Summary

• Pin fixed fast-uri, ip-address, undici, and brace-expansion resolutions across the affected workspaces.
• Update the legacy minimatch compatibility guard to the fixed brace-expansion release.
• Add lockfile and regression coverage so the high-severity dependency gate cannot silently regress.
• Regenerate the governed release manifest.

Root cause

The Governance partition was correctly failing on high advisories in the locked dependency trees. The findings were transitive: AJV/fast-uri and express-rate-limit/ip-address in backend, and ESLint/minimatch/brace-expansion and Cloudflare/miniflare/undici in frontend and website.

Verification

• Repository tests: passed, including 158 baseline tests, 18 chat tests, 43 legal-source tests, and 28 security tests.
• npm run audit:high: passed for backend, frontend, and website with zero high or critical advisories.
• Backend TypeScript build: passed.
• Frontend production build and TypeScript: passed.
• Website production build and lint: passed.
• Release-manifest verification: passed.
• Frontend strict lint remains at the pre-existing 25-error/42-warning baseline and is outside this dependency-only diff.

Production deployment is intentionally unchanged.

[ranade-oss]

Exact-head Baseline run open-legal-products#239 passed on head 2a7b3d5249dd7b19157bc35d2ab04b1ee48c5284.

Passed: workflow validation, backend build/tests, frontend production build, website build/lint/routes, Governance and release checks including audit:high, and the final all-partitions verification.

The PR remains draft because this dependency-security remediation requires explicit security review before it can be marked ready or merged. Production was not touched.