chore(deps): bump js-cookie 3.0.5 -> 3.0.7 to clear high-severity audit

GHSA: cookie-attribute injection via prototype hijack in assign().
Patch bump; no API changes for our usage.

Author: 0xdevcollins

package-lock.json

@@ -115,7 +115,7 @@
     "gray-matter": "^4.0.3",
     "gsap": "^3.13.0",
     "input-otp": "^1.4.2",
-    "js-cookie": "^3.0.5",
+    "js-cookie": "^3.0.7",
     "lodash.debounce": "^4.0.8",
     "lucide-react": "^0.525.0",
     "marked": "^16.3.0",