Patch in-range dependency advisories and override brace-expansion

Runs `npm audit fix`, which resolves every remaining runtime advisory
without any manifest change, since all of them were satisfiable inside
the existing semver ranges: express 4.21.1 -> 4.22.2 (picking up patched
body-parser, qs, and path-to-regexp), node-forge 1.2.1 -> 1.4.0,
response-time 2.3.2 -> 2.3.4 (patched on-headers), plus transitive
fixes for form-data's critical CRLF injection, fast-uri, js-yaml, yaml,
picomatch, and @babel/core.

The dev tooling needed a heavier hand. eslint and jest reach
brace-expansion through half a dozen intermediate minimatch versions,
and the advisory range (<=5.0.7) covers the entire 1.x and 2.x lines
with no backported patch, so no in-range fix exists. npm's suggested
remedy was jest@25, which is a downgrade from the 29 in use rather than
a fix. An override pinning brace-expansion to ^5.0.8 is the honest
alternative: 5.x publishes a CommonJS build alongside its ESM entry
point, so the CJS consumers under eslint and jest resolve it fine, and
its node 20/22 engine floor is already below what this project builds
on. Lint and the full unit suite pass unchanged under the override.

This takes `npm audit` from 22 findings to 2, both of which are exact
version pins handled separately.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>