fix(security): remediate production dependency audit findings

[code3ks]

Summary

Remediates the production dependency audit for the demo (issue #223).

Before → after (pnpm audit --prod):

Severity	Before	After
Critical	1	0
High	53	1
Moderate	86	8
Low	7	2
Total	147	11

What changed

1. Upgraded patched direct dependencies (package.json) and refreshed pnpm-lock.yaml:
   react-router-dom 7.18.4, @stellar/stellar-sdk 13.3.0, @ckb-ccc/ccc 1.3.6,
   wagmi 2.19.5, @rainbow-me/rainbowkit 2.2.11, viem 2.57.7,
   @solana/web3.js 1.99.0, the @solana/wallet-adapter-* set,
   @walletconnect/core + sign-client 2.26.0, and @tanstack/react-query 5.104.3.

2. Forced patched transitive versions via pnpm.overrides for findings only
   reachable deep in the tree: axios 1.20.0, form-data 4.0.6, hono 4.13.13,
   socket.io-parser 4.2.7, browserslist 4.29.3, image-size 2.0.4,
   shell-quote 1.12.0 (removes the critical finding), toml 4.2.0, and ws 8.22.0.

3. Documented the unavoidable transitive findings with owner and expiry in
   docs/SECURITY_AUDIT.md. The only remaining high is braces
   (GHSA-vfj7-8cjw-p6xm) — the latest published release (3.0.3) is the affected
   version, and it is only reachable through React Native/Metro build tooling
   pulled in by the Solana Mobile wallet adapter (not in the browser bundle).
   The remaining moderate/low findings are listed with the same owner/expiry.

4. Added a CI threshold for new critical findings: pnpm audit:gate
   (scripts/audit-gate.mjs) runs pnpm audit --prod --json and fails when
   critical > 0 (or high > the accepted baseline). Wired into
   .github/workflows/ci.yml.

Why overrides instead of major bumps

Several advisories (e.g. axios/toml via @stellar/stellar-sdk, axios/ws
via @ckb-ccc, react-native transitives via the Solana Mobile adapter) only have
fixes behind breaking major releases of packages we don't control. Forcing
compatible patched versions keeps runtime behaviour intact; where that is not
possible the finding is documented rather than ignored. The toml override is
safe because the demo never calls StellarToml.Resolver.

Verification

• pnpm build — passes (tsc + vite + PWA service worker build).
• pnpm audit:gate — 0 critical, 1 high, 8 moderate, 2 low → gate passes.
• pnpm test:unit — 266 passed; 2 failures in nameWatchlistStore.test.ts are
  pre-existing and environment-only (jsdom 30 / undici 8.11.2 on Node 20;
  both versions are unchanged by this PR and CI runs Node 22).
• pnpm format:check — clean.

Notes for reviewers

• The 90-day expiries in docs/SECURITY_AUDIT.md are all 2027-01-15; adjust
  the owner if another team should own these exceptions.
• Raising the CI baseline requires a matching owner+expiry entry in the doc.

Closes #223

[vercel]

@code3ks is attempting to deploy a commit to the truthixify's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@code3ks Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[truthixify]

Thanks. Two blockers remain:

• The audit gate treats JSON errors without vulnerability metadata as zero findings and passes. Please require a successful audit result and add a registry-error regression test.
• Global overrides cross declared major ranges: Stellar SDK requests toml 3 but receives 4, Metro and Jayson request ws 7 but receive 8, and Metro requests image-size 1 but receives 2. Please scope or remove these overrides, or add compatibility coverage for every affected path.

The merged-state unit suite otherwise shows only the known #208 failures.

[truthixify]

The previous blockers are addressed on b5fad70. The audit gate now fails closed on registry/error payloads, and the major-crossing overrides are path-scoped with focused compatibility coverage. I reran the 18 gate/compatibility tests, the live production audit (0 critical, 1 high), and the production build on the merge ref; all pass.