Bump vulnerable deps to patch Dependabot alerts

[kylekeesling]

Bumps five gems in Gemfile.lock to resolve all 11 open Dependabot alerts (4 high, 4 medium, 3 low).

Gem	Before	After	Alerts
faraday	2.14.0	2.14.3	#20 (high), #15 (low), #9 (medium)
concurrent-ruby	1.3.5	1.3.7	#18 (high), #19 (low), #17 (low)
activesupport	8.1.1	8.1.3	#13, #12, #11 (medium)
erb	5.1.3	6.0.4	#14 (high)
json	2.15.2	2.21.1	#10 (high)

Notable: faraday #20 (high) — stack-exhaustion DoS via deeply nested query params — is the only alert on a direct runtime dependency; the rest are transitive.

Conservative bundle update — only the affected gems moved. All 103 tests pass locally.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}