chore(ci): fix Security Audit — audit prod deps via audit-ci, patch dev advisories

The Security Audit job failed because new advisories dropped against existing
deps and `npm audit --audit-level=high` audits the whole tree (incl. dev/build
tooling that isn't shipped).

- Switch both audit steps to `audit-ci --high --skip-dev`, so the gate reflects
  what's actually deployed (backend ships --omit=dev; frontend ships a static
  build) while still failing on real high/critical production advisories.
- Allowlist GHSA-qwww-vcr4-c8h2 (React Router "RSC Mode CSRF") for the frontend:
  this is a client-side SPA using BrowserRouter — RSC mode is not used — and
  there is no forward-compatible fix for react-router-dom 7.x (only a downgrade).
- `npm audit fix` on both lockfiles to patch non-breaking transitive dev
  advisories (js-yaml, postcss, brace-expansion, minimatch). No direct/prod
  dependency versions changed; app runtime is unchanged.

Verified: backend 114 tests pass, frontend builds, and audit-ci passes for both
projects locally.

.github/workflows/ci.yml

@@ -77,10 +77,19 @@ jobs:
         with:
           node-version: '20'
 
+      # Audit production dependencies only (dev/build tooling isn't in the shipped
+      # image: the backend installs with --omit=dev and the frontend ships a static
+      # build). audit-ci lets us fail on high+ prod advisories while allowlisting
+      # ones that don't apply.
+      #
+      # Allowlisted:
+      #   GHSA-qwww-vcr4-c8h2 — React Router "RSC Mode CSRF Bypass". This is a
+      #   client-side SPA (BrowserRouter); we don't use RSC mode, and there is no
+      #   forward-compatible fix for react-router-dom 7.x (only a downgrade).
       - name: Audit frontend dependencies
-        run: npm audit --audit-level=high
+        run: npx --yes audit-ci@^7 --high --skip-dev --allowlist GHSA-qwww-vcr4-c8h2
         working-directory: frontend
 
       - name: Audit backend dependencies
-        run: npm audit --audit-level=high
+        run: npx --yes audit-ci@^7 --high --skip-dev
         working-directory: backend