Dependency audit follow-up

[jiushiaaa]

Current npm audit reports:

• 5 moderate
• 1 high
• 1 critical

Do not run npm audit fix --force blindly.
Investigate whether findings affect production/runtime surface.
Handle in a dedicated dependency-maintenance release.