fix(deps): clear the fast-uri high advisory that fails the npm audit gate

[PeterGuy326]

Preflight

• Searched open and closed PRs for related changes (fix(ci): verify fails on the fast-uri high advisory in npm audit #528 tracks the failing gate; fix(ci): Node 24 / ubuntu-latest fails on the service-connections PAT token assertion #512/fix(services): keep unsaved connection drafts across background refreshes #513 cover the service-connections PAT assertion, untouched here).
• No credentials, personal data, private paths, or private screenshots.
• Branch created from main @ f2fca7b; the only change is package-lock.json.

Summary

verify fails on main because npm run security:check (npm audit --audit-level=high) exits 1 on the fast-uri high advisory (#528). Lockfile-only, non-breaking bumps:

Package	Before	After	Reason
fast-uri	3.1.6	3.1.8	GHSA-qw65-cvwx-89v3, GHSA-58mr-gqgx-xq4g (high)
undici	6.28.0	6.29.0	GHSA-3wwx-pv8p-q78v (moderate)
undici	7.29.0	7.30.0	GHSA-3wwx-pv8p-q78v (moderate)

Produced with npm audit fix --package-lock-only; no manifest range changed, no breaking bump taken, node_modules untouched.

Evidence

• Before: npm audit --audit-level=high --package-lock-only reports 4 vulnerabilities (1 high, 3 moderate) and exits 1 on main @ f2fca7b.
• After: the same command reports 2 moderate vulnerabilities (the @vitest/mocker chain that requires vitest 5) and exits 0, so the --audit-level=high gate passes.

Assumptions

• --audit-level=high is meant to block high and critical only; the remaining moderates do not fail the gate. If the gate should be moderate-clean too, that is the vitest 5 upgrade discussed in fix(ci): verify fails on the fast-uri high advisory in npm audit #528 — breaking, deliberately not taken here.
• Node 24 failures matching the App.test.tsx toolbar-timeout signature of ci(renderer): App context navigation toolbar test times out on fresh runs of main (both platforms) #529 on this PR's runs are unrelated to this change (lockfile-only); they reproduce on fresh runs of main itself.

Acceptance

• npm run security:check passes on CI (the verify workflow's audit gate).
• No package.json change: lockfile-only, semver-compatible bumps; install/build behavior unchanged.

Closes #528

[Bindy-lbb]

复审通过：改动仅涉及 package-lock.json 中 fast-uri 3.1.8 与 undici 6.29.0/7.30.0 三个条目；package.json 未变，锁定版本符合对应依赖范围并高于 GHSA 公告中的修复版本，registry integrity 也匹配。当前 verify、Dependency review、CodeQL 等检查全绿。