fix(deps): clear all 14 frontend advisories, and unblock npm ci

[sagehen03]

Clears all 14 advisories in frontend/package-lock.json — 3 critical, 8 high,
2 moderate, 1 low — and makes the result installable by CI.

Why this wasn't a one-liner

npm update on its own fixes every advisory. The problem is the lockfile it
produces, which npm ci refuses — and frontend-ci.yml runs npm ci, so that
result cannot ship. It fails with two messages that contradict each other:

Invalid: lock file's cac@7.0.0 does not satisfy cac@6.7.14
Missing: cac@7.0.0 from lock file

The cause is @bomb.sh/tab, pulled in by @nuxt/cli. It declares cac and
commander as optional peer dependencies, so an absent or mismatched
version should be ignored. But both are present hoisted for other consumers —
cac@7 for fast-npm-meta, commander@11 for svgo. npm hoists versions its
own optional-peer ranges then reject, and it validates that strictly under ci
while tolerating it under install.

@bomb.sh/tab@0.0.22 widens the cac peer to ^6.7.14 || ^7.0.0. Overriding to
it lets npm hoist a tree that satisfies every consumer:

	before (rejected)	after
root cac	7.0.0	6.7.14
root commander	11.1.0	15.0.0
fast-npm-meta/…/cac	—	7.0.0
svgo/…/commander	—	11.1.0

That one override is the entire fix. No direct dependency's declared range
changed — every advisory's fix was already inside the range the lockfile had
gone stale against.

What moved

nuxt         3.21.7  -> 3.21.11      axios         1.17.0 -> 1.19.0
postcss      8.5.15  -> 8.5.26       tar           7.5.16 -> 7.5.22
shell-quote  1.8.3   -> 1.10.0       nanoid        3.3.12 -> 3.3.18
@nuxt/devtools 3.2.4 -> 3.4.1        svgo          4.0.1  -> 4.0.2
esbuild      0.27.7  -> 0.28.2       immutable     5.1.5  -> 5.1.9
form-data    4.0.5   -> 4.0.6        launch-editor 2.13.2 -> 2.14.1
brace-expansion 5.0.6 -> 5.0.9

All patch or minor. No direct dependency crosses a major.

What was actually exposed

Worth separating, because severity alone overstates it. All three criticals
were build- or dev-time only: the @nuxt/devtools unauthenticated RPC (reaches
a developer's host, not the server), shell-quote, and tar.

The one that reached shipped code was nuxt: server-side RCE via runtime
template injection in server island props (>=3.4.0 <3.21.10), plus a route
rule auth bypass where mixed-case paths silently skipped appMiddleware
gates. axios is also runtime, carrying ten advisories — mostly prototype
pollution and DoS.

Verification

• npm ci from a clean directory — passes (this is the check that failed before)
• npm audit — 0 vulnerabilities
• 191 frontend tests pass
• nuxt build completes

Supersedes

These Dependabot PRs are covered by this change and can close once it merges:
#47 (form-data 4.0.6), #46 (launch-editor 2.14.1), #45 (shell-quote 1.8.4).

🤖 Generated with Claude Code

https://claude.ai/code/session_01J6tzeGkxhib4vWYYYzR4Md