PR #223 merged: fix(deps): clear remaining high/moderate advisories + enforce audit gate

Summary

Follow-up to #222 (which auto-merged with qs only). Clears the remaining high/moderate npm advisories and flips the CI audit step to an enforced gate.

npm audit: 32 vulns (7 high) → 1 low (@babel/core, dev-only, only fixable via a Babel 8 major that breaks ts-jest — accepted).

Overrides

Runtime (via @modelcontextprotocol/sdk → express/hono stack): hono 4.12.25, @hono/node-server 2.0.5, express-rate-limit 8.5.2, path-to-regexp 8.4.2, ajv 8.20.0 (scoped to SDK), fast-uri 4, ip-address 10.2.0 Dev tooling: flatted 3.4.2, brace-expansion 5.0.6, picomatch 4.0.4, js-yaml 4.2.0, markdown-it 14.2.0

ajv is scoped to the SDK only — eslint 10 needs ajv ^6.14.0 (not vulnerable) and breaks on ajv 8.18+ (removed json-schema-draft-04.json).

CI

Security audit step drops continue-on-error → enforced gate at --audit-level=high.

Verification

lint ✅ (0 errors) · build ✅ · 361/361 tests ✅ · clean stdio boot ✅ · npm audit --audit-level=high exits 0