fix(deps): bump axios to >=1.16.0 to remediate CVE-2026-44488/44492/44494/44496

Tree resolved axios@1.14.0 (< 1.16.0), inside the affected range of all
four advisories. The blanket override resolved to 1.14.1, then a stale
'axios@1.14.1: 1.14.0' redirect (a prior supply-chain pin) pulled it back
to the now-vulnerable 1.14.0.

- Direct dep: ^1.12.0 -> ^1.16.0
- Override: axios >=1.13.5 -> >=1.16.0
- Stale redirect: axios@1.14.1 1.14.0 -> >=1.16.0

Lockfile now resolves axios@1.18.0 everywhere; no resolution < 1.16.0
remains. axios@0.30.4 pin left untouched (0.x, below the >=1.0.0 CVE floor).

Author: FJ-Riveros

package.json

@@ -15,7 +15,7 @@
     "@babel/runtime": "^7.26.10",
     "@kamino-finance/klend-sdk": "^3.2.7",
     "@solana/web3.js": "^1.95.2",
-    "axios": "^1.15.2",
+    "axios": "^1.16.0",
     "base-x": "^3.0.11",
     "brace-expansion": "^1.1.13",
     "dotenv": "^16.4.5",

pnpm-lock.yaml

@@ -21,8 +21,8 @@ overrides:
   "bigint-buffer": "npm:bigint-buffer-fixed@^1.1.5"
   "tar": ">=7.5.11"
   "minimatch": ">=3.1.4"
-  "axios": ">=1.15.2"
-  "axios@1.14.1": "1.15.2"
+  "axios": ">=1.16.0"
+  "axios@1.14.1": ">=1.16.0"
   "axios@0.30.4": "0.30.3"
   "brace-expansion@<1.1.13": "1.1.13"
   "brace-expansion@>=4.0.0 <5.0.6": "5.0.6"