fix(ci): verify fails on the fast-uri high advisory in npm audit #528

Preflight

• Searched open and closed issues for duplicates (nothing existing for npm audit, security:check or fast-uri).
• Removed credentials, personal data, private paths, and private screenshots.
• This is not a security vulnerability — it is a dependency-audit gate failure. ByteFolk Security Baseline is unaffected.

Summary

The verify job now fails after all tests pass, in the security:check step:

npm audit --audit-level=high   -> exit 1
4 vulnerabilities (3 moderate, 1 high)

The high one is new:

fast-uri  3.0.0 - 3.1.6   Severity: high   node_modules/fast-uri
  GHSA-qw65-cvwx-89v3  authority injection via an unvalidated port in serialize
  GHSA-58mr-gqgx-xq4g  host confusion via an unclosed bracket in the URI authority
  fix available via `npm audit fix`

And three moderate ones, which do not trip --audit-level=high:

@vitest/mocker  2.1.0 - 4.1.10                   GHSA-82fw-gwwq-j7x9  (needs vitest 5, i.e. --force)
undici          6.25.0-6.28.0 || 7.28.0-7.29.0   GHSA-3wwx-pv8p-q78v  (x2)

This is not branch-specific. The gate re-reads the advisory database on every run, so the default branch will fail the same way on its next push, and so will every open PR — including PRs that touch no dependency at all.

Evidence

So the gate flipped somewhere between 2026-09-28T15:26Z and 2026-09-29T00:34Z with no commit in between: an advisory was published, not a regression introduced.

The two earlier failures in that same job on the same commit are separate and already tracked: attempt 1 was the service-connections PAT assertion of #512 (fix pending in #513), attempt 2 was the App.test.tsx:268:3 5000ms timeout flake that also hits unrelated branches and main.

Assumptions

• --audit-level=high is meant to gate high and critical only; the three moderate advisories should not, on their own, break this step. If the intent is "zero advisories", say so and the fix scope becomes the vitest major bump too.
• The gate should stay fail-closed: this issue is about resolving the advisory, not about lowering --audit-level.

Acceptance

• npm run security:check exits 0 on the default branch.
• verify is green again for a PR that changes no dependency, without a rerun.

Refs #527