Upgrade Bun to 1.4.4 (security fixes in 1.4.3 and 1.4.4) #2920

Motivation

Bun 1.4.0 → 1.4.4 to pick up the security fixes shipped in 1.4.3 and 1.4.4:

• CVE-2026-48618 — TLS certificate name matching in tls.connect, tls.checkServerIdentity, https, fetch and Bun.connect.
• CVE-2023-44487 / CVE-2025-8671 — node:http2 stream-reset flooding.
• bun install hardening: stricter registry and tarball URL parsing before attaching credentials, malformed bin fields, malformed tar archives (also affects bun create and github: dependencies).

Scope

• Pin the runtime in package.json (packageManager, engines.bun), .github/actions/setup-js, .github/workflows/status.yml, apps/web/vercel.json, apps/mobile/eas.json, the four Dockerfiles, and the docs that state the runtime version.
• @types/bun → 1.4.3 (the latest published; 1.4.4 does not exist on npm).
• Regenerate the root and apps/media-server lockfiles with 1.4.4.

Acceptance

• bun install --frozen-lockfile and bun run check:bun pass with bun --version = 1.4.4.
• tsc-rs -b reports 0 errors; the web and render-farm builds pass.
• Docker images build and their in-image tests pass (deferred to a follow-up session; unticked in the PR test plan).

PR

#2919