chore(deps): upgrade deps to fix vulns

[son-oz]

Run npm audit fix for semver-safe updates and bump eslint-config-next 14.0.0 → ^15.5.18 to align with Next.js 15 and drop the outdated @typescript-eslint toolchain.

Resolved (15 of 18):

Critical:

• form-data: unsafe random boundary + CRLF injection (GHSA-fjxv-7rqg-78g4, GHSA-hmw2-7cc7-3qxx) — via axios → 1.18.1

High:

• axios: DoS, SSRF via NO_PROXY bypass, prototype-pollution gadgets, CRLF/null-byte injection, credential leaks, ReDoS (multiple advisories) — axios → 1.18.1
• ws: uninitialized memory disclosure + DoS (GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p) — via ethers → 6.17.0
• minimatch: ReDoS via wildcards / GLOBSTAR backtracking / nested extglobs (GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-23c5-xmqv-rm74) — incl. @typescript-eslint chain via eslint-config-next ^15.5.18
• picomatch: method injection + ReDoS via extglob quantifiers (GHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj)

Moderate:

• ajv: ReDoS via $data option (GHSA-2g4f-4pwh-qvx6)
• brace-expansion: ReDoS + zero-step sequence hang (GHSA-v6h2-p8h4-qcjw, GHSA-f886-m6hf-6m8v)
• follow-redirects: auth header leak to cross-domain redirect (GHSA-r4q5-vmmm-2653)
• js-yaml: prototype pollution + quadratic-complexity DoS in merge keys (GHSA-mh29-5h37-fv8m, GHSA-h67p-54hq-rp68)
• yaml: stack overflow via deeply nested collections (GHSA-48c2-rrv3-qjmp)
• postcss (dev): XSS via unescaped </style> (GHSA-qx2v-qp2m-jg93)

Not fixed (3 moderate, no fix available — accepted):

• postcss <8.5.10 bundled inside next / @next/third-parties (GHSA-qx2v-qp2m-jg93). No stable next release fixes this (next 16 still bundles postcss 8.4.31 and forces a React 19 major). Build-time only, not runtime-exploitable for this app; revisit when next ships a patched postcss.

Verified: npm run lint and npm run build pass; audit reports 0 high/critical.