fast-uri's override already admits the fix, so only the lock pin moves

[GraemeF]

Clears five HIGH advisories by moving fast-uri 4.1.1 -> 4.1.3 in
bun.lock. One line, no manifest change.

• GHSA-7p8r-x3mc-p8w7 — fixed in 4.1.2
• GHSA-5jgf-p345-68v8 — host confusion via skipped IDN canonicalisation
• GHSA-f65p-4m7j-42xc — SSRF via malformed authority
• GHSA-fph4-wmhf-6fwf — SSRF via repeated components
• GHSA-jqff-g426-hqxp — host confusion via percent-encoded scheme

The last four were published 2026-09-02 and are all fixed in 4.1.3, so
the same one-line move that this branch already carried for the first
one clears all five once the pin lands on 4.1.3 rather than 4.1.2.

Why it's a lockfile-only change

fast-uri is transitive. It arrives through ajv, which declares
fast-uri: ^3.0.1, and package.json's overrides block already
raises that to ^4.1.1. 4.1.3 satisfies the override, so the lock pin
was the only thing holding the tree on the vulnerable version. The
override also collapses ajv onto the single 4.x resolution, so
bun.lock holds exactly one fast-uri entry and one pin move covers
the tree — there is no 3.x copy left behind, and the 3.x line is
vulnerable to all five.

Why the entry is edited rather than re-resolved

bun update fast-uri does not fix this. It reports installed fast-uri@4.1.1, leaves the lock entry unmoved, and adds fast-uri to
the root package.json as a direct dependency pinned exactly — because
bunfig.toml sets exact = true. The manifest changes and the
vulnerable copy stays. PR #216 recorded the same behaviour for
ip-address.

Editing the single lock line keeps the diff to what the advisories
require. bun install --frozen-lockfile accepts the result against a
wiped node_modules — which is also what verifies the hand-written
integrity hash, since bun checks the tarball against it — and the only
copy in the tree is node_modules/.bun/fast-uri@4.1.3.

Supply-chain gate

bunfig.toml sets minimumReleaseAge = 604800. 4.1.3 published
2026-08-23, so it clears the seven-day window by 11 days. The gate was
not lowered or bypassed.

fast-uri 4.1.4 published 2026-09-02 and is inside the window until
2026-09-09. The override's caret admits it, so the gate is what holds
this resolution at 4.1.3. No advisory here names 4.1.4.

Not in this PR

• GHSA-v2hh-gcrm-f6hx is fixed in fast-uri 4.1.1 and main is
  already there. No work.
• A release. commy carries 27 commits unreleased since
  commy-v0.22.0, tracked as comms-ngz0. This merge fixes main, not
  the published npm bundle.

Raised by nixos-config from osv-scanner findings; tracked as
comms-k9f9.