Fix all backend lint errors and security vulnerabilities

Backend lint (4 errors fixed):
- auth.ts: suppress @typescript-eslint/no-namespace on Express global
  augmentation (legitimate TS pattern for extending Request type)
- clients.ts: remove unnecessary \. escape in regex character class
- devices.ts: remove unnecessary \- escape by moving hyphen to front [-:]
- PollerService.ts: add comment to empty catch block

Security audit (high/critical CVEs fixed):
- frontend: bump axios (critical SSRF), lodash (high injection),
  follow-redirects (moderate) via npm audit fix
- backend: bump nodemailer 6.x → 8.0.5 (fixes 4 SMTP injection CVEs)

backend/src/routes/clients.ts

@@ -251,7 +251,7 @@ router.get('/:mac/signal', async (req: Request, res: Response) => {
 // POST /api/clients/:mac/wol — send Wake-on-LAN magic packet
 router.post('/:mac/wol', requireWrite, async (req: Request, res: Response) => {
   const mac = req.params.mac.replace(/[^0-9a-fA-F:.-]/g, '');
-  const hexMac = mac.replace(/[:\-\.]/g, '');
+  const hexMac = mac.replace(/[:\-.]/g, '');
   if (hexMac.length !== 12) {
     return res.status(400).json({ error: 'Invalid MAC address' });
   }

backend/src/routes/devices.ts

@@ -1464,7 +1464,7 @@ router.post('/:id/tools/wol', requireWrite, async (req: Request, res: Response)
   if (!iface) return res.status(400).json({ error: 'interface is required' });
 
   // Basic MAC validation
-  if (!/^([0-9A-Fa-f]{2}[:\-]){5}[0-9A-Fa-f]{2}$/.test(mac)) {
+  if (!/^([0-9A-Fa-f]{2}[-:]){5}[0-9A-Fa-f]{2}$/.test(mac)) {
     return res.status(400).json({ error: 'Invalid MAC address format' });
   }