[NebiyatS]

pnpm audit --prod` goes from 68 findings (4 critical, 35 high) to none.

Dependency changes

• OpenTelemetry stack updated to current majors (sdk-node 0.300, auto-instrumentations-node 0.82, resources 3, exporter-trace-otlp-grpc replaces exporter-otlp-grpc)
• koa ^2.16.4, @koa/cors 5, multer 2, convict 6, jsonwebtoken 9, jwks-rsa 3, uuid 11
• koa-multer replaced by @koa/multer (koa-multer is pinned to multer 1)
• Removed the vitest/otel peer dependency rule

Code changes needed by the upgrades

• config: convict 6 dropped the ipaddress and url formats, replaced with custom formats (net.isIP / URL.canParse)
• publish: @koa/multer exposes uploaded files on ctx.request.files
• otel: new resource and semantic-convention APIs, sdk.start() is synchronous, getEnv removed
• token validation: handle a missing signing key (jwks-rsa 3 types)

Testing

• build, lint, format and the 17 vitest tests pass
• Compared against master on two real published databases: /rest/v3 (latest, markers, trees, transactions) and /graphql responses are byte-identical
• Real Promaster JWT validated against the Keycloak JWKS: valid token accepted, wrong tenant, tampered and missing token rejected
• OTel starts and traces initialise