fix(security): resolve dependabot alerts via npm audit fix

[asachs01]

Resolves all 7 open dependabot alerts (dev-scope npm transitives, package-lock.json only):

• undici 6.27.0 -> 6.28.0 (GHSA-v3r7-h72x-cjcm, GHSA-m8rv-5g2x-5cg5, GHSA-8xcm-r25x-g524)
• ip-address 10.2.0 -> 10.5.0 (GHSA-mwp4-54f8-5fhr, GHSA-4xrf-jv44-h6hh, GHSA-22jq-vg5j-6vgg)
• esbuild 0.27.7 -> 0.27.2, outside vulnerable range 0.27.3-0.28.1 (GHSA-g7r4-m6w7-qqqr)
• npm 11.18.0 -> 11.19.1 (bundles patched ip-address/tar/undici), nanoid 3.3.18, tar 7.5.22

Verification: npm audit reports 0 vulnerabilities; npm run build succeeds; npm test 68/68 passing (8 files).

Part of the Vanta SOC2 dependabot burn-down.

https://claude.ai/code/session_01LYL1ivhJKNwnHRCdTSuAom

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 68bdd768-0cf2-4628-8908-23a77093f178

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}