fix(deps): bump axios to >=1.16.0 to remediate CVE-2026-44488/44492/44494/44496

Tree resolved axios@1.14.0 (< 1.16.0), inside the affected range of all
four advisories. The blanket override resolved to 1.14.1, then a stale
'axios@1.14.1: 1.14.0' redirect (a prior supply-chain pin) pulled it back
to the now-vulnerable 1.14.0.

- Direct dep: ^1.12.0 -> ^1.16.0
- Override: axios >=1.13.5 -> >=1.16.0
- Stale redirect: axios@1.14.1 1.14.0 -> >=1.16.0

Lockfile now resolves axios@1.18.0 everywhere; no resolution < 1.16.0
remains. axios@0.30.4 pin left untouched (0.x, below the >=1.0.0 CVE floor).

Author: FJ-Riveros

package.json

@@ -15,7 +15,7 @@
     "@babel/runtime": "^7.26.10",
     "@kamino-finance/klend-sdk": "^3.2.7",
     "@solana/web3.js": "^1.95.2",
-    "axios": "^1.12.0",
+    "axios": "^1.16.0",
     "base-x": "^3.0.11",
     "brace-expansion": "^1.1.12",
     "dotenv": "^16.4.5",
@@ -27,14 +27,15 @@
       "bigint-buffer": "npm:bigint-buffer-fixed@^1.1.5",
       "tar": ">=7.5.11",
       "minimatch": ">=3.1.4",
-      "axios": ">=1.13.5",
-      "axios@1.14.1": "1.14.0",
+      "axios": ">=1.16.0",
+      "axios@1.14.1": ">=1.16.0",
       "axios@0.30.4": "0.30.3",
       "plain-crypto-js@4.2.1": "0.0.0-security",
       "lodash": ">=4.17.23",
       "bn.js": ">=5.2.3",
       "base-x": "^5.0.1",
       "@tootallnate/once": ">=3.0.1"
     }
-  }
+  },
+  "packageManager": "pnpm@10.13.1+sha512.37ebf1a5c7a30d5fabe0c5df44ee8da4c965ca0c5af3dbab28c3a1681b70a256218d05c81c9c0dcf767ef6b8551eb5b960042b9ed4300c59242336377e01cfad"
 }