From e4df8e61c18e3c60e200cf186b743b07930e1954 Mon Sep 17 00:00:00 2001
From: Sage Hart <sagehart@MacBookAir.attlocal.net>
Date: Sun, 12 Jul 2026 10:43:45 -0500
Subject: [PATCH] fix(security): resolve Scorecard quality and supply-chain
 alerts

Pin remaining GitHub Actions and base image digests, scope workflow
write permissions to jobs, remove tracked hook bytecode, and tighten
dependency overrides to reduce open vulnerability findings.
---
 .../hooks/__pycache__/_common.cpython-313.pyc | Bin 10184 -> 0 bytes
 .github/workflows/cd-promote-production.yml   |  12 +-
 .github/workflows/codeql-analysis.yml         |   6 +-
 .github/workflows/docker-publish.yml          |  13 +-
 .github/workflows/docs-link-check.yml         |   4 +-
 .github/workflows/release.yml                 |   9 +-
 .github/workflows/scorecard.yml               |   2 +-
 .gitignore                                    |   4 +-
 Dockerfile                                    |   2 +-
 package-lock.json                             | 360 ++++++++----------
 package.json                                  |   3 +-
 11 files changed, 198 insertions(+), 217 deletions(-)
 delete mode 100644 .cursor/hooks/__pycache__/_common.cpython-313.pyc

diff --git a/.cursor/hooks/__pycache__/_common.cpython-313.pyc b/.cursor/hooks/__pycache__/_common.cpython-313.pyc
deleted file mode 100644
index 0209f249c9db2c19d759766fbaf4386910c442fa..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 10184
zcmb_iUvL}8dA|b=00|Hv2~ng(O6HNGNJ1n)iPWD+iX=lML{Z{D<H*P{$sh;dNJ0c~
zn7xB2!gNZz(^^#AGEVHVrqfR4ms)x0$nAqYedsuo%rt!}7&s++QIoXEWF~J+q_iFN
zrN2Gk4v<XKO{XVecW?LGZ@=CB{vRK^-A)G2AHIF<=J`Vm^9%Z7Jf32MeSF)-Fz+%)
z8G#{;zzUY@>@^Fq@U(5cZY5T|<_M?PHe%CjJF)AvgE;iMid3QIu2)}k5+~2h+QN;-
zLghMqu-rCUg6$MrY!f$Tfy(EfaO?9u3?tY-XN9)U!p^z{$0<v(->6Cb?=`>5oag;L
zXskANc7g3Kkri)Y7@SU3xbw4gwlk+nonZsK0*LGvE(*?O<|aoPg-e1<Z#4-o3N?D`
zfDjbidh4KYSr`;Nw0)B$&9nCK=?XNZW;-L)8q^7OCoP`~Rc}Ih_kh}GLN)9Gwcmtl
z+ykn~ggUSX)Ik%fc@L--6Y9_&P=`&Z7xsW^HKF)DpxR8R_C27Em{1*iKpi!qI!{{q
zYRDm>Yxc0v-Gw_8h6JB}+b;;mNb3nk=viV3kGdCin-CKG`e^&--fI9OS3b)Z2A>Ok
zd(d_K3+A5KV{ZQ!%pKTc?#VBhdkUw-kq-ToPM1#UjD8MBF>`k*_|o1uN$2OzJo^PR
zyM%M3Teu>e*D3G`!@`&K)-kj$=&hawtM97#64altC=w~oFG|UbL==8rCj4NQD5!4r
z^U1`#6kCZUC4Nzsmz03hIg-lAM8$;Y3a=!h$wYcVALEr6Nn}(dz=!2%R#ACX=G8@s
zUzW)dg^4GK6jNogQo`;`irI8*QBsPS`FSFzdVw(=llYjJOj26JcpNwqAS#iRx|9kW
zK(4GPfsCjwf~Fx!Ni3xKq`1s?-|F|B<3)ZUE0Q=b-A*W~!prI83ZIzgzmBb@B}L(}
zVO0`SUk89hVhIIQB-8+ZU6L}+xTJ#6gbaN0LL!EPAri01zzO0Oa1t?@WU>l~O!KOQ
zjY_v9>?$Uwm265P0q3tNYx`KuC8pD|DpFL+INq(n^h&P!8-0P8e!SYg!RfFt5sqA)
zn7AGpofwV`jf6E0iz=EuC8cmwT5SnrDjXaPMMj2VB~zjcj{~KZVc5qnqW4|q1!hL?
zrbW0CuGHJk%y0$(%%$Zl%<PQa=m}RDt#Tc9mD@(kG!t&4r(7FjX-frObA>WoxVGFj
zTE^V)E_em2z@24h>I~Q!uh9xO7_D+$Vaj%K0|c93=a^|ma0Iw%HpHf_Gp1uuaemEZ
zd`2sL*l3mO@`+AcJd98^U@?_gwcr$7XRQ_{%}sN=xe+tGfhXK<w90imGi^0haE%`W
z#v7a?8~taj#4`)FHl~*`>~<V7J&(I>g|Vk&7p$$!Jln?1bQstjj0nD=5DT_>ra10%
z=R(0uMoPzdFuF>zF*Qro0+>5plw~<Cu0RH_2@~U^JS0XbiAaDSrxL&uk;+kE3Y=c0
z%UwiX(j1Be!H6rgQ%$5KB_qYge@$=F$7vQ-K`#+wQX~-vXhuxahD~2HXAj&|Ah;SU
z=4@GY-v1>XaXKc)A%+_3^zG9uG7zN1B?-z!(Hw>hRmDYBqN`~fZD}@@(ymn}6dBqr
zC90Y=EiY@;5kssrE}Nwb)AFQdU6gKXoQ$*3II3VY?xvhbYqn*Q05XnJrP<=yR7TON
zL$_m6hDx~4M(VLEeMM2T()H|6cruA=mia{mZZ5;qN1N)KR-oJZ6mda<I#T<F<mGfy
z7UN1^FssUGIVD56gsuwwn3x7kik`o)qNq}eH&jQTu8jL4F*%iz(}4{32DK5<&y7%C
zp)9TZ1jQP&!?|tlM^(-Z*Im~;!}sGqs_J><Y1~Myr?xz8o1V6U=g5}Fzv=N8Jbibp
zzw|b5d5>&*k8F9nHoaX1uW!pcu<0H6_^WyEK;Aq2=s??}rk3||-_Ct!b*rgsv#INW
z^?^6v)VsaE`8U;euXD%A)b87Hp>@ap#KU;J@3g<y^>){Ly>Iva`SOE-2S*>=df+K|
z&wRY^ljR?|C-TDdc8zD_>iX4prrvwy+ppZW7xs5O=-AvJ__U_)Kdp>slHGDo{Ih%F
zzklg!c+9Xi_rFxt>{wAhRgPnSZw$JI>X`4leS?>*-#=YN+n1a}ZpRO*t!V$it(SGq
zp~Kc69AZ(%FvonTI)oswkN+NxFIJ#odWp|HhT2L)rG%+Me(o{G4dE1_l4eX*8`dMF
zXQx2$O;PV)jx!w$M7PF(f#`w?9{q}?6=SCOvbmwKBtm#0z!{M!l5Tvdu;O)v@|R)N
z705U>iI8$g(sR=5b7)o=R?VglY8(Mh`U2BVj)Dlyrn4%c9u75WL|j%_w0Y7?N1YTt
zl1OK=Dxq8N!B4r0g7P6}^FH#_ZzR?e8|n3Q!Sli$>vsFm4}9<YKInPB=Ph+3cQ<$M
z$T$BWUv=tXKZ^f)RJ?NUc5VILYI^D3r^*2!dm~sCbTi*`v9xs81P@ui*TSNVQA&)5
zUY35je}%@oUtk+|yV?pHW?q<qoM9@jsjQhREXXbvcrSYjP0ji&IsOJ!GEl+#%@OEJ
zI1hNot<ER2%3@&LXD59iL$l+CWE?Zq>iX4?PTFnL!RXb<(VLZ5!%3-xO3nf1Bz_9L
zt~KVDoa4=FuV35Z8aBCxk_1}66Zw=o`lxc`$6VuMz%#o`&kGpA0h@<Uor~ja`A`-Z
zpLJYw!n;f*bgQA+;NQv1-(_`jzRQsFz@Re_xky{IpoA*aPgr9faaDJE?>X|-{ExXd
z9rhVF2$x*EXgcLxWDa25Edfi~GHph_BF8W<dj%`y+A^KfmS<?>#-Y5W^oq|yE&xue
z$wE&@V6v#D*4!x4s_{xL0m5e`gQ&<5g|^}@6iNzod~qw6=@>2Ob`*L@Ys|K<?~_BD
z&Eso>KXo*0xAxwd*sMB4_qXqlM)aNK&im<eIW#;n&Uarr7Z!s2YG{yOotO-b3&K@?
zb%^#%4o~vFOOxS|uLP$;{PoaR^;tPrh9qvm;_*w;O0Hox8oWLdoH_148}z?2_v(q$
zugykt^}!ngFUDfj3kDRQi097DMj^!!SZX4vk>XecW3$S!nR6HBXw@~_K6hybXheSw
z`1*S0UOjo7qT5f=6=zmp%{9$N7Zx*-@{GAx2lV9+4JXvA*(gs#4LL0)jY+D!B&BnQ
z=(HKwKQgz=+?vwdBJ2yZ(cALvnW&f{%ACKnOOWTsPLKD#mU9V7F}8##gd#pN8&#J4
zIL{1`Z~A=|TZsU^AMn^q!vsuzaKx{uEAaAzlOy^u9>g(@<izp<bjH9bI>9q6%QPS`
zKq>i2cnlTPRG_C@9~Jl5y0R2WCT>ZQ@=_q}q)u9+KsB(0aO@Uh5&fcc;tuQk64O}H
zyqt<9>w{@^k;oZDF%>k@W6OxrZijZL;?VeR0A~77h_sM=xwa&tsTnn!NlG(B3QUTs
zDv|UItiv24H<WW)tq>Xvho&Nv!KtZGcwBf!B|{2}k~)vZyRdVHRirNK0$Wy|`<Sc9
zyJew5Gu~-7OvUQCr)(ol9Dp8!i#}~pEIcfuiz%tpP*{R1o90Ethfyi12e>paorlk;
z@{5UuML%5B`2=J?W*+XmoK44jc_|6yJ1(as=v@oB0wSPyC6UAyeO8TArQ53Jz=hLe
zfMulUpV0xDYd(>Vmn4gfV)_mI6zZX^F~4%vZrASnS+j55bH}mm@@`yQzj&`>%hg(N
zwQlb_aCh`KHm2p+j-9Eg(^Z4dma7U#x5X5WKj#Q2#YS}ij$tMVq0iX@aokUi3uLm<
zi~Dq16Y)q~5j8t%g1QQ|6r(*(+KTs|I(6c#=7QW~^J+p&Do?q9l)m-U9!N_niP1Wf
zLhXQ$nMt5gO@{-JqIjuEBjBe_y*DW%Zhu;%w-r@ffSdlb)`Uku0XMnSL1zVu@O6QO
zgzB#(p|0XZj{%<Ue-2A&YNOsAhufQ!Gt^Hm_Ftst8XFOn7|NSVbW>1gC^IMeX(^>>
zIe(j$nI&ulqY6?J(lgvjxeh<}@esIkFK*o}*xt>dDD!NZ1y}FkEy8wL!qr&+xo5`o
z7Y)m0aKETa&@@~26sb+sdnvA60&c+!FQ36-DNEt5`=UY4b5Gfh>Joc$nkxtBWh&s_
zaN}2|NEowyPO={rX-A<|MMb!zBBC|;mdg@B^auxaIf1~dHWC~iowyMZrmtKXc{wC#
z^^uZ(xf~Qi<H0d>Il*c~Ey7nRnIzmNNM(%y7<ze1Ky0S3#L<<=O}Z!>(X4<g$7MzT
zwLU@ZU|LD2R1wpx6Hx)4!cTb(#TxTdDzy!dT<(oC>u0uHEt{^EdqV|R+uG1}P2I+|
z^=sc8T?=hHYTo?D>)&`s-g0zqIyy07+u{1OmM=JXh&)EO98H^!rhE1+N9(4e6@8D~
zwHr6qZ)~{_Z@LfPlM3#R*RQMvw;j&6k_AUIo#ZNNf!x4sv^x%+KCAQ~xE1M^R!i@A
zOG>MV-P1AX0|4k9K3J-DWXSZGp4t!LrBS|nC_FLA_wiHV>G47M5WYYTwj?ekk^I6$
znv6p=yW9io-+g|y!<XxrhK@`^(;+D^6dDb|@90j;{Ee%jaEOl~nWsoVQa2k-EzK+4
zvjNQYUBc4MS8$35DQNs!jJ}a7OQqn^26A338J~>?j?G5p`3rrJ<i1=Ba(*<@ra41o
z`9$OumU)aMVp2e>8wySZBSRqpbPrCAd?oaZ#O`fhDnfw&H~YeTm!*aw3)Uc4QNSe}
zq3vrZH0$!>%CqKRzitlbwMF9P3n43jeha^nVbED@-_H(ouh;Bi7#i<hgJC%6D;tJf
z7miVmElC7dhO^DciZmNtH9BG4N?o~sg9r4r)tU31tFy|S4==NUKHsHM;<gX(N(%0h
zpK52k_%n-Ou9^OUIp3w#xRgoCEAWlrRIMtK6kjFM0?ds>{BbEN<r3KxHKS=g$Gf^L
zLZ`zcj>@<FaU_P)fJcrfF|T7#vBYvB?a#oaLH-#0i)?3cwE+W+rj1o1Nq(eM7o_rH
z3R1=?QCU^8QN%O;dCXt(-;|@i*?_V*8_fow2uISYv_SO4YoAWAk(<_&%m}7<-I>=@
z({v5KJ76rQ^!a$C!}%zT6VgijzpuSR1L+m`3CM!MYe-=;{E&XyaCxYQsYl!}h*@|K
z^Dv<_L2S4a0e%wLkidaVD!jfGUO$HfB$VdQsGybc5-B6|M3z-h)Ms2v>D&woiwA<u
z`U1QlseDmG-k1nqp9+UUk->?v$q6BJ;Y2a%y}T$POAWedFoSG2^kXccA{#CPErHLY
z1a=ppUx6Q~(F@}|pML~1xU2ZM2=@z_Ny~1|nvn#7+1nkTX^JZFHB)?_1J4=euLAym
zv%W>J>3LfFH0xmotkgJlFh0k)<|wHo4N@Chj%#(LuNFhbM~j@Z%pw}g`z)Gu0UlC6
zFu)Up52&YD$g6lK)KEMt_YFviM2rhW)(-r6TP1G*?g533pg?R`+qm)S`m6WO7HW@f
z)%HB_Zh87QJ^cmG$+cnX9-d!6|E+Anb$H8l<$lu#E$_GF{g(=DFXHu+%UjN|P3Ks_
zIk7gl?P|IgyElEm?f&rnv-uYPrpuq_{Kc@j@-9vHrXRikm;6YX3k1u#mrKrub;fjS
z%I=QgVCZhX6?eKzB2D=GJGJfR3YB@P>=f<x?O@vERg(&E)=cRS5b&kMjl+NL`Rp9g
zjydM{hYkiG&+NIO%T!75gGKeK>w!dB^YFSZ-A(@(jKG7_0$Stl0<5to#*6H<3hI2-
zy2GS7;C&~EoF;4N)EP);LCs~zeIy*x4UyIu85y4n4TpnMBNO8hVK6*0IfX&(V8m1v
zl>lSHFzndt6f5On1=55}M$sv1)vcC6HCWlyt`S{LlDh!@YdR}~0!bxD^_#iZbJPRM
zHwFrhzJ~(^$7$;1xLWT!wp`ttu5Rkl?7{Dk9NsO*!A-}(dtF<O_Dx6or=4Hk>Kxqc
z9Q<T>t8;X-bM#SdcfP87+f};<XVY9^Wn!w#k&t>e*L)f3dl{bzbqfi74DX2-lL=7?
z_*i{YsOXVYrqNoSJ&clVEgb|k;(tdcP^Q8`xQ;zIQ*aIBxq)H?XD@yuu)-H3lpUXX
z;)$3_1L$5J9|z~?Cj%O*Y8;I@aUmN3B7cg)$C0x}yV(0J+FOF4ZL&-|?8TJSpU{pW
z6i?wE6Mj{XVJqfwMK?tU)7N;LPUdtsnV7vA7nS8Cx^=#wWE4?+y9oSTua2Tub3`I=
zMj{c-8Hvni=|`kUgivKe=yen`mDKsyEJV^XnS`dsG`orbGrd4K3e-+}oUm4~t<-R7
zF7s3AScv>F1zDrT5n42%(41qTv5D|k=_gb||73^ov_Lw5(Z7f2$!I;>Sj;e9#(=K$
zGt|Y`<NDf2q~d!mXr|#hNzx)k3(DJiFrYa{hQ}wup+SToMbD4=Z{$r{+@ZxfEvRzW
zd5BP^ATQE_+MA+CRed=Hhao9lB!7WE7C&VJB8MC|%l_8lV7cGbG3=3FFttBnTt8u|
z_5V(^|CMR{xu<SpVSQoC!*6={`z-~Jf6cY+tl2oWerzMK9>^aIJhXh|_|WlD&4)D~
z&-}2naQvl$GrZ>5E=Cv|v+J|>dhXvYxR0+n>8BTjEF0tN<N21}LXCf`Cit-7qvpS9
z{@X)aCxV+Nf@{@J?6s`>Nr#>FKJi-FrYAKl+x{O_9P8O>VC+?IzVgN^`MU9fZ6g2D
z*YaFs+vX^Cbro#g`C}LI+(ol%tY90@PcG!SMYHQz!Pb-aU(a)+W>;UqcKl%=&jrn%
z69rrU!?8Sf+3Y!8u${@Doyc>OW>;^)=Fj(C%5yK8T@+Kke=^U#^jz1qJa^sfI$p4y
z$PZk}bHip=dE(AN_i4*oZN9$$G2><}Pk0Agx6{b%yUMQB{?=mOZ^<+Dzx6P6)9hN!
z6T644-|00E<;o8&|K$Ehcft0RZJUpNz3BP5aX7~xwtwXR&|k2D*d99MH;0bg4}UQC
z{#?N}kU#ZOo(r2q9lcLJc<uey3bs@EGgEnPddKZJgXQb+UG6dC0BsF+(AL1z)^FUr
zdozD<@RRUA%zbaJ;1R$d2V4HK`OlhnES$}Q4|E`7?Det7Zbvf^H12pg+bFwZW!PqV
T!+|F?)ok7G4p`WeI>Y`Cm{1a^

diff --git a/.github/workflows/cd-promote-production.yml b/.github/workflows/cd-promote-production.yml
index a3e610d..c1d5450 100644
--- a/.github/workflows/cd-promote-production.yml
+++ b/.github/workflows/cd-promote-production.yml
@@ -44,7 +44,7 @@ jobs:
       SKIP_ENV_VALIDATION: "1"
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Validate inputs
         env:
@@ -59,18 +59,18 @@ jobs:
 
       - name: Setup Node (Vercel prebuilt)
         if: ${{ github.event.inputs.deploy_vercel == 'true' }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: "22"
           cache: npm
 
       - name: Install dependencies
         if: ${{ github.event.inputs.deploy_vercel == 'true' }}
-        run: npm ci
+        run: npx npm@10.9.2 ci
 
       - name: Install Vercel CLI
         if: ${{ github.event.inputs.deploy_vercel == 'true' }}
-        run: npm install --global vercel@latest
+        run: npm install --global vercel@55.0.0
 
       - name: Pull Vercel env (production)
         if: ${{ github.event.inputs.deploy_vercel == 'true' }}
@@ -98,14 +98,14 @@ jobs:
 
       - name: Configure AWS credentials (OIDC)
         if: ${{ github.event.inputs.rollout_eks == 'true' }}
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
         with:
           role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
           aws-region: ${{ vars.AWS_REGION }}
 
       - name: Install kubectl
         if: ${{ github.event.inputs.rollout_eks == 'true' }}
-        uses: azure/setup-kubectl@v5
+        uses: azure/setup-kubectl@829323503d1be3d00ca8346e5391ca0b07a9ab0d # v5
 
       - name: kubeconfig (EKS)
         if: ${{ github.event.inputs.rollout_eks == 'true' }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index eb78492..3aa0987 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -35,12 +35,12 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 03d408a..36c2fc0 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -27,10 +27,7 @@ on:
 
 permissions:
   contents: read
-  packages: write
   id-token: write
-  attestations: write
-  artifact-metadata: write
 
 env:
   IMAGE_NAME: ehs-web
@@ -38,6 +35,12 @@ env:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+      artifact-metadata: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # GHCR requires lowercase org/repo in image URL paths.
       - name: Image coordinates
@@ -56,7 +59,7 @@ jobs:
 
       - name: Build and push
         id: push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7
         with:
           context: .
           push: true
@@ -69,7 +72,7 @@ jobs:
           cache-to: type=gha,mode=max
 
       - name: Attest provenance (SLSA-aligned)
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4
         with:
           subject-name: ${{ steps.image.outputs.registry }}
           subject-digest: ${{ steps.push.outputs.digest }}
diff --git a/.github/workflows/docs-link-check.yml b/.github/workflows/docs-link-check.yml
index 796b9d5..5b71afc 100644
--- a/.github/workflows/docs-link-check.yml
+++ b/.github/workflows/docs-link-check.yml
@@ -17,9 +17,9 @@ jobs:
   link-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       - name: Markdown link check
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2
         with:
           args: >-
             --no-progress
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 372cc9d..f3883b4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,14 +11,15 @@ concurrency:
   group: semantic-release-${{ github.repository }}
   cancel-in-progress: false
 
-permissions:
-  contents: write
-  issues: write
-  pull-requests: write
+permissions: read-all
 
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 9463e0a..76b78fd 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -30,7 +30,7 @@ jobs:
           publish_results: true
 
       - if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           sarif_file: results.sarif
           category: scorecard
diff --git a/.gitignore b/.gitignore
index 46c9cff..fe3d535 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,8 +16,10 @@
 /playwright-report/
 /blob-report/
 
-# Cursor (keep skills/rules tracked; omit local logs)
+# Cursor (keep skills/rules tracked; omit local logs and bytecode)
 .cursor/*.log
+.cursor/**/__pycache__/
+*.pyc
 
 # next.js
 /.next/
diff --git a/Dockerfile b/Dockerfile
index d0d27f4..481b6f5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -32,7 +32,7 @@
 #   env at runtime   → ConfigMap + Secret (never commit raw Secret YAML with data)
 # =============================================================================
 
-FROM node:22-bookworm-slim AS base
+FROM node:22-bookworm-slim@sha256:53ada149d435c38b14476cb57e4a7da73c15595aba79bd6971b547ceb6d018bf AS base
 WORKDIR /app
 # Disable Next telemetry in CI/images unless org policy wants it.
 ENV NEXT_TELEMETRY_DISABLED=1
diff --git a/package-lock.json b/package-lock.json
index 3485620..98233a8 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -165,13 +165,13 @@
       "license": "MIT"
     },
     "node_modules/@babel/code-frame": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.0.tgz",
-      "integrity": "sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.29.7.tgz",
+      "integrity": "sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-validator-identifier": "^7.28.5",
+        "@babel/helper-validator-identifier": "^7.29.7",
         "js-tokens": "^4.0.0",
         "picocolors": "^1.1.1"
       },
@@ -180,9 +180,9 @@
       }
     },
     "node_modules/@babel/compat-data": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.3.tgz",
-      "integrity": "sha512-LIVqM46zQWZhj17qA8wb4nW/ixr2y1Nw+r1etiAWgRM6U1IqP+LNhL1yg440jYZR72jCWcWbLWzIosH+uP1fqg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.29.7.tgz",
+      "integrity": "sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -190,21 +190,21 @@
       }
     },
     "node_modules/@babel/core": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.0.tgz",
-      "integrity": "sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.29.7.tgz",
+      "integrity": "sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-compilation-targets": "^7.28.6",
-        "@babel/helper-module-transforms": "^7.28.6",
-        "@babel/helpers": "^7.28.6",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/traverse": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-compilation-targets": "^7.29.7",
+        "@babel/helper-module-transforms": "^7.29.7",
+        "@babel/helpers": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/remapping": "^2.3.5",
         "convert-source-map": "^2.0.0",
         "debug": "^4.1.0",
@@ -221,14 +221,14 @@
       }
     },
     "node_modules/@babel/generator": {
-      "version": "7.29.1",
-      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.1.tgz",
-      "integrity": "sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.29.7.tgz",
+      "integrity": "sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/parser": "^7.29.0",
-        "@babel/types": "^7.29.0",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "@jridgewell/gen-mapping": "^0.3.12",
         "@jridgewell/trace-mapping": "^0.3.28",
         "jsesc": "^3.0.2"
@@ -238,14 +238,14 @@
       }
     },
     "node_modules/@babel/helper-compilation-targets": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.28.6.tgz",
-      "integrity": "sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.29.7.tgz",
+      "integrity": "sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/compat-data": "^7.28.6",
-        "@babel/helper-validator-option": "^7.27.1",
+        "@babel/compat-data": "^7.29.7",
+        "@babel/helper-validator-option": "^7.29.7",
         "browserslist": "^4.24.0",
         "lru-cache": "^5.1.1",
         "semver": "^6.3.1"
@@ -255,9 +255,9 @@
       }
     },
     "node_modules/@babel/helper-globals": {
-      "version": "7.28.0",
-      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.28.0.tgz",
-      "integrity": "sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-globals/-/helper-globals-7.29.7.tgz",
+      "integrity": "sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -265,29 +265,29 @@
       }
     },
     "node_modules/@babel/helper-module-imports": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.28.6.tgz",
-      "integrity": "sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.29.7.tgz",
+      "integrity": "sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/traverse": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/traverse": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/helper-module-transforms": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.28.6.tgz",
-      "integrity": "sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.29.7.tgz",
+      "integrity": "sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-module-imports": "^7.28.6",
-        "@babel/helper-validator-identifier": "^7.28.5",
-        "@babel/traverse": "^7.28.6"
+        "@babel/helper-module-imports": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7",
+        "@babel/traverse": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -297,9 +297,9 @@
       }
     },
     "node_modules/@babel/helper-string-parser": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
-      "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -307,9 +307,9 @@
       }
     },
     "node_modules/@babel/helper-validator-identifier": {
-      "version": "7.28.5",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
-      "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -317,9 +317,9 @@
       }
     },
     "node_modules/@babel/helper-validator-option": {
-      "version": "7.27.1",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.27.1.tgz",
-      "integrity": "sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.29.7.tgz",
+      "integrity": "sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -327,27 +327,27 @@
       }
     },
     "node_modules/@babel/helpers": {
-      "version": "7.29.2",
-      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.2.tgz",
-      "integrity": "sha512-HoGuUs4sCZNezVEKdVcwqmZN8GoHirLUcLaYVNBK2J0DadGtdcqgr3BCbvH8+XUo4NGjNl3VOtSjEKNzqfFgKw==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.29.7.tgz",
+      "integrity": "sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0"
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/parser": {
-      "version": "7.29.3",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.3.tgz",
-      "integrity": "sha512-b3ctpQwp+PROvU/cttc4OYl4MzfJUWy6FZg+PMXfzmt/+39iHVF0sDfqay8TQM3JA2EUOyKcFZt75jWriQijsA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz",
+      "integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/types": "^7.29.0"
+        "@babel/types": "^7.29.7"
       },
       "bin": {
         "parser": "bin/babel-parser.js"
@@ -357,33 +357,33 @@
       }
     },
     "node_modules/@babel/template": {
-      "version": "7.28.6",
-      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.28.6.tgz",
-      "integrity": "sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.29.7.tgz",
+      "integrity": "sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.28.6",
-        "@babel/parser": "^7.28.6",
-        "@babel/types": "^7.28.6"
+        "@babel/code-frame": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/types": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
       }
     },
     "node_modules/@babel/traverse": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.0.tgz",
-      "integrity": "sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.29.7.tgz",
+      "integrity": "sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/code-frame": "^7.29.0",
-        "@babel/generator": "^7.29.0",
-        "@babel/helper-globals": "^7.28.0",
-        "@babel/parser": "^7.29.0",
-        "@babel/template": "^7.28.6",
-        "@babel/types": "^7.29.0",
+        "@babel/code-frame": "^7.29.7",
+        "@babel/generator": "^7.29.7",
+        "@babel/helper-globals": "^7.29.7",
+        "@babel/parser": "^7.29.7",
+        "@babel/template": "^7.29.7",
+        "@babel/types": "^7.29.7",
         "debug": "^4.3.1"
       },
       "engines": {
@@ -391,14 +391,14 @@
       }
     },
     "node_modules/@babel/types": {
-      "version": "7.29.0",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.0.tgz",
-      "integrity": "sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==",
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz",
+      "integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "@babel/helper-string-parser": "^7.27.1",
-        "@babel/helper-validator-identifier": "^7.28.5"
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
       },
       "engines": {
         "node": ">=6.9.0"
@@ -4426,9 +4426,9 @@
       }
     },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.5",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
-      "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
+      "version": "5.0.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
+      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -5383,9 +5383,9 @@
       "license": "MIT"
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.10.25",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.25.tgz",
-      "integrity": "sha512-QO/VHsXCQdnzADMfmkeOPvHdIAkoB7i0/rGjINPJEetLx75hNttVWGQ/jycHUDP9zZ9rupbm60WRxcwViB0MiA==",
+      "version": "2.10.43",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.43.tgz",
+      "integrity": "sha512-AjYpR78kDWAY3Efj+cDTFH9t9SCoL7OoTp1BOb0mQV7S+6CiLwnWM3FyxhJtdPufDFKzmCSFoUncKjWgJEZTCQ==",
       "license": "Apache-2.0",
       "bin": {
         "baseline-browser-mapping": "dist/cli.cjs"
@@ -5568,9 +5568,9 @@
       }
     },
     "node_modules/browserslist": {
-      "version": "4.28.2",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.2.tgz",
-      "integrity": "sha512-48xSriZYYg+8qXna9kwqjIVzuQxi+KYWp2+5nCYnYKPTr0LvD89Jqk2Or5ogxz0NUMfIjhh2lIUX/LyX9B4oIg==",
+      "version": "4.28.6",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.6.tgz",
+      "integrity": "sha512-FQBYNK15VMslhLHpA7+n+n1GOlF1kId2xcCg7/j95f24AOF6VDYMNH4mFxF7KuaTdv627faazpOAjFzMrfJOUw==",
       "dev": true,
       "funding": [
         {
@@ -5588,10 +5588,10 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "baseline-browser-mapping": "^2.10.12",
-        "caniuse-lite": "^1.0.30001782",
-        "electron-to-chromium": "^1.5.328",
-        "node-releases": "^2.0.36",
+        "baseline-browser-mapping": "^2.10.42",
+        "caniuse-lite": "^1.0.30001803",
+        "electron-to-chromium": "^1.5.389",
+        "node-releases": "^2.0.51",
         "update-browserslist-db": "^1.2.3"
       },
       "bin": {
@@ -5669,9 +5669,9 @@
       }
     },
     "node_modules/caniuse-lite": {
-      "version": "1.0.30001791",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001791.tgz",
-      "integrity": "sha512-yk0l/YSrOnFZk3UROpDLQD9+kC1l4meK/wed583AXrzoarMGJcbRi2Q4RaUYbKxYAsZ8sWmaSa/DsLmdBeI1vQ==",
+      "version": "1.0.30001805",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001805.tgz",
+      "integrity": "sha512-52noaS3DubycKSXaU30TwPGIp+POyQSUVa5jBEq3vkRkY0kjyb3LQgvhU6WGyCcyXqVLWO0Cw0Q6BSdD0kUfVA==",
       "funding": [
         {
           "type": "opencollective",
@@ -7078,9 +7078,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.349",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.349.tgz",
-      "integrity": "sha512-QsWVGyRuY07Aqb234QytTfwd5d9AJlfNIQ5wIOl1L+PZDzI9d9+Fn0FRale/QYlFxt/bUnB0/nLd1jFPGxGK1A==",
+      "version": "1.5.389",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.389.tgz",
+      "integrity": "sha512-cEto7aeOqBfU1D+c5py5pE+ooscKE75JifxLBdFUZsqAxRS6y7kebtxAZvICszSl05gPjYHDTjY+lXpyGvpJbg==",
       "dev": true,
       "license": "ISC"
     },
@@ -10375,34 +10375,6 @@
         }
       }
     },
-    "node_modules/next/node_modules/postcss": {
-      "version": "8.4.31",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.4.31.tgz",
-      "integrity": "sha512-PS08Iboia9mts/2ygV3eLpY5ghnUcfLV/EXTOW1E2qYxJKGGBUtNjN76FYHnMs36RmARn41bC0AZmn+rR0OVpQ==",
-      "funding": [
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/postcss/"
-        },
-        {
-          "type": "tidelift",
-          "url": "https://tidelift.com/funding/github/npm/postcss"
-        },
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/ai"
-        }
-      ],
-      "license": "MIT",
-      "dependencies": {
-        "nanoid": "^3.3.6",
-        "picocolors": "^1.0.0",
-        "source-map-js": "^1.0.2"
-      },
-      "engines": {
-        "node": "^10 || ^12 || >=14"
-      }
-    },
     "node_modules/node-emoji": {
       "version": "2.2.0",
       "resolved": "https://registry.npmjs.org/node-emoji/-/node-emoji-2.2.0.tgz",
@@ -10439,11 +10411,14 @@
       }
     },
     "node_modules/node-releases": {
-      "version": "2.0.38",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.38.tgz",
-      "integrity": "sha512-3qT/88Y3FbH/Kx4szpQQ4HzUbVrHPKTLVpVocKiLfoYvw9XSGOX2FmD2d6DrXbVYyAQTF2HeF6My8jmzx7/CRw==",
+      "version": "2.0.51",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.51.tgz",
+      "integrity": "sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": ">=18"
+      }
     },
     "node_modules/non-error": {
       "version": "0.1.0",
@@ -10499,9 +10474,9 @@
       }
     },
     "node_modules/npm": {
-      "version": "11.13.0",
-      "resolved": "https://registry.npmjs.org/npm/-/npm-11.13.0.tgz",
-      "integrity": "sha512-cRmhaghDWA1lFgl3Ug4/VxDJdPBK/U+tNtnrl9kXunFqhWw1x4xL5txkNn7qzPuVfvXOmXyjHpMwsuk2uisbkg==",
+      "version": "11.18.0",
+      "resolved": "https://registry.npmjs.org/npm/-/npm-11.18.0.tgz",
+      "integrity": "sha512-T67M4L5wNm0cZ7EBLErcEkY1SmzEW/WJ+SADBzsFUY1UdAPfFHXFQtZ6SEXiK0+vzXysCvAsepbMaBTwnrAD+w==",
       "bundleDependencies": [
         "@isaacs/string-locale-compare",
         "@npmcli/arborist",
@@ -10580,8 +10555,8 @@
       ],
       "dependencies": {
         "@isaacs/string-locale-compare": "^1.1.0",
-        "@npmcli/arborist": "^9.4.3",
-        "@npmcli/config": "^10.8.1",
+        "@npmcli/arborist": "^9.9.0",
+        "@npmcli/config": "^10.12.0",
         "@npmcli/fs": "^5.0.0",
         "@npmcli/map-workspaces": "^5.0.3",
         "@npmcli/metavuln-calculator": "^9.0.3",
@@ -10599,46 +10574,46 @@
         "fs-minipass": "^3.0.3",
         "glob": "^13.0.6",
         "graceful-fs": "^4.2.11",
-        "hosted-git-info": "^9.0.2",
+        "hosted-git-info": "^9.0.3",
         "ini": "^6.0.0",
         "init-package-json": "^8.2.5",
         "is-cidr": "^6.0.4",
         "json-parse-even-better-errors": "^5.0.0",
         "libnpmaccess": "^10.0.3",
-        "libnpmdiff": "^8.1.6",
-        "libnpmexec": "^10.2.6",
-        "libnpmfund": "^7.0.20",
+        "libnpmdiff": "^8.1.11",
+        "libnpmexec": "^10.3.1",
+        "libnpmfund": "^7.0.25",
         "libnpmorg": "^8.0.1",
-        "libnpmpack": "^9.1.6",
-        "libnpmpublish": "^11.1.3",
+        "libnpmpack": "^9.1.11",
+        "libnpmpublish": "^11.2.0",
         "libnpmsearch": "^9.0.1",
         "libnpmteam": "^8.0.2",
-        "libnpmversion": "^8.0.3",
-        "make-fetch-happen": "^15.0.5",
+        "libnpmversion": "^8.0.4",
+        "make-fetch-happen": "^15.0.6",
         "minimatch": "^10.2.5",
         "minipass": "^7.1.3",
         "minipass-pipeline": "^1.2.4",
         "ms": "^2.1.2",
-        "node-gyp": "^12.3.0",
+        "node-gyp": "^12.4.0",
         "nopt": "^9.0.0",
         "npm-audit-report": "^7.0.0",
         "npm-install-checks": "^8.0.0",
         "npm-package-arg": "^13.0.2",
         "npm-pick-manifest": "^11.0.3",
-        "npm-profile": "^12.0.1",
+        "npm-profile": "^12.0.2",
         "npm-registry-fetch": "^19.1.1",
         "npm-user-validate": "^4.0.0",
         "p-map": "^7.0.4",
-        "pacote": "^21.5.0",
+        "pacote": "^21.5.1",
         "parse-conflict-json": "^5.0.1",
         "proc-log": "^6.1.0",
         "qrcode-terminal": "^0.12.0",
         "read": "^5.0.1",
-        "semver": "^7.7.4",
+        "semver": "^7.8.5",
         "spdx-expression-parse": "^4.0.0",
         "ssri": "^13.0.1",
         "supports-color": "^10.2.2",
-        "tar": "^7.5.13",
+        "tar": "^7.5.19",
         "text-table": "~0.2.0",
         "tiny-relative-date": "^2.0.2",
         "treeverse": "^3.0.0",
@@ -10724,7 +10699,7 @@
       "license": "ISC"
     },
     "node_modules/npm/node_modules/@npmcli/agent": {
-      "version": "4.0.0",
+      "version": "4.0.2",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
@@ -10740,7 +10715,7 @@
       }
     },
     "node_modules/npm/node_modules/@npmcli/arborist": {
-      "version": "9.4.3",
+      "version": "9.9.0",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
@@ -10788,7 +10763,7 @@
       }
     },
     "node_modules/npm/node_modules/@npmcli/config": {
-      "version": "10.8.1",
+      "version": "10.12.0",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
@@ -10982,7 +10957,7 @@
       }
     },
     "node_modules/npm/node_modules/@sigstore/core": {
-      "version": "3.2.0",
+      "version": "3.2.1",
       "dev": true,
       "inBundle": true,
       "license": "Apache-2.0",
@@ -11030,13 +11005,13 @@
       }
     },
     "node_modules/npm/node_modules/@sigstore/verify": {
-      "version": "3.1.0",
+      "version": "3.1.1",
       "dev": true,
       "inBundle": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@sigstore/bundle": "^4.0.0",
-        "@sigstore/core": "^3.1.0",
+        "@sigstore/core": "^3.2.1",
         "@sigstore/protobuf-specs": "^0.5.0"
       },
       "engines": {
@@ -11105,7 +11080,7 @@
       }
     },
     "node_modules/npm/node_modules/bin-links": {
-      "version": "6.0.0",
+      "version": "6.0.2",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
@@ -11133,7 +11108,7 @@
       }
     },
     "node_modules/npm/node_modules/brace-expansion": {
-      "version": "5.0.5",
+      "version": "5.0.7",
       "dev": true,
       "inBundle": true,
       "license": "MIT",
@@ -11202,7 +11177,7 @@
       }
     },
     "node_modules/npm/node_modules/cidr-regex": {
-      "version": "5.0.4",
+      "version": "5.0.5",
       "dev": true,
       "inBundle": true,
       "license": "BSD-2-Clause",
@@ -11326,7 +11301,7 @@
       "license": "ISC"
     },
     "node_modules/npm/node_modules/hosted-git-info": {
-      "version": "9.0.2",
+      "version": "9.0.3",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
@@ -11425,7 +11400,7 @@
       }
     },
     "node_modules/npm/node_modules/ip-address": {
-      "version": "10.1.0",
+      "version": "10.2.0",
       "dev": true,
       "inBundle": true,
       "license": "MIT",
@@ -11507,12 +11482,12 @@
       }
     },
     "node_modules/npm/node_modules/libnpmdiff": {
-      "version": "8.1.6",
+      "version": "8.1.11",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.4.3",
+        "@npmcli/arborist": "^9.9.0",
         "@npmcli/installed-package-contents": "^4.0.0",
         "binary-extensions": "^3.0.0",
         "diff": "^8.0.2",
@@ -11526,13 +11501,13 @@
       }
     },
     "node_modules/npm/node_modules/libnpmexec": {
-      "version": "10.2.6",
+      "version": "10.3.1",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
         "@gar/promise-retry": "^1.0.0",
-        "@npmcli/arborist": "^9.4.3",
+        "@npmcli/arborist": "^9.9.0",
         "@npmcli/package-json": "^7.0.0",
         "@npmcli/run-script": "^10.0.0",
         "ci-info": "^4.0.0",
@@ -11549,12 +11524,12 @@
       }
     },
     "node_modules/npm/node_modules/libnpmfund": {
-      "version": "7.0.20",
+      "version": "7.0.25",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.4.3"
+        "@npmcli/arborist": "^9.9.0"
       },
       "engines": {
         "node": "^20.17.0 || >=22.9.0"
@@ -11574,12 +11549,12 @@
       }
     },
     "node_modules/npm/node_modules/libnpmpack": {
-      "version": "9.1.6",
+      "version": "9.1.11",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
-        "@npmcli/arborist": "^9.4.3",
+        "@npmcli/arborist": "^9.9.0",
         "@npmcli/run-script": "^10.0.0",
         "npm-package-arg": "^13.0.0",
         "pacote": "^21.0.2"
@@ -11589,7 +11564,7 @@
       }
     },
     "node_modules/npm/node_modules/libnpmpublish": {
-      "version": "11.1.3",
+      "version": "11.2.0",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
@@ -11633,7 +11608,7 @@
       }
     },
     "node_modules/npm/node_modules/libnpmversion": {
-      "version": "8.0.3",
+      "version": "8.0.4",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
@@ -11649,7 +11624,7 @@
       }
     },
     "node_modules/npm/node_modules/lru-cache": {
-      "version": "11.3.5",
+      "version": "11.5.1",
       "dev": true,
       "inBundle": true,
       "license": "BlueOak-1.0.0",
@@ -11658,7 +11633,7 @@
       }
     },
     "node_modules/npm/node_modules/make-fetch-happen": {
-      "version": "15.0.5",
+      "version": "15.0.6",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
@@ -11824,7 +11799,7 @@
       }
     },
     "node_modules/npm/node_modules/node-gyp": {
-      "version": "12.3.0",
+      "version": "12.4.0",
       "dev": true,
       "inBundle": true,
       "license": "MIT",
@@ -11948,13 +11923,13 @@
       }
     },
     "node_modules/npm/node_modules/npm-profile": {
-      "version": "12.0.1",
+      "version": "12.0.2",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
       "dependencies": {
         "npm-registry-fetch": "^19.0.0",
-        "proc-log": "^6.0.0"
+        "proc-log": "^6.1.0"
       },
       "engines": {
         "node": "^20.17.0 || >=22.9.0"
@@ -12001,7 +11976,7 @@
       }
     },
     "node_modules/npm/node_modules/pacote": {
-      "version": "21.5.0",
+      "version": "21.5.1",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
@@ -12062,7 +12037,7 @@
       }
     },
     "node_modules/npm/node_modules/postcss-selector-parser": {
-      "version": "7.1.1",
+      "version": "7.1.4",
       "dev": true,
       "inBundle": true,
       "license": "MIT",
@@ -12159,7 +12134,7 @@
       "optional": true
     },
     "node_modules/npm/node_modules/semver": {
-      "version": "7.7.4",
+      "version": "7.8.5",
       "dev": true,
       "inBundle": true,
       "license": "ISC",
@@ -12183,17 +12158,17 @@
       }
     },
     "node_modules/npm/node_modules/sigstore": {
-      "version": "4.1.0",
+      "version": "4.1.1",
       "dev": true,
       "inBundle": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@sigstore/bundle": "^4.0.0",
-        "@sigstore/core": "^3.1.0",
+        "@sigstore/core": "^3.2.1",
         "@sigstore/protobuf-specs": "^0.5.0",
-        "@sigstore/sign": "^4.1.0",
-        "@sigstore/tuf": "^4.0.1",
-        "@sigstore/verify": "^3.1.0"
+        "@sigstore/sign": "^4.1.1",
+        "@sigstore/tuf": "^4.0.2",
+        "@sigstore/verify": "^3.1.1"
       },
       "engines": {
         "node": "^20.17.0 || >=22.9.0"
@@ -12210,12 +12185,12 @@
       }
     },
     "node_modules/npm/node_modules/socks": {
-      "version": "2.8.7",
+      "version": "2.8.9",
       "dev": true,
       "inBundle": true,
       "license": "MIT",
       "dependencies": {
-        "ip-address": "^10.0.1",
+        "ip-address": "^10.1.1",
         "smart-buffer": "^4.2.0"
       },
       "engines": {
@@ -12284,7 +12259,7 @@
       }
     },
     "node_modules/npm/node_modules/tar": {
-      "version": "7.5.13",
+      "version": "7.5.19",
       "dev": true,
       "inBundle": true,
       "license": "BlueOak-1.0.0",
@@ -12312,7 +12287,7 @@
       "license": "MIT"
     },
     "node_modules/npm/node_modules/tinyglobby": {
-      "version": "0.2.16",
+      "version": "0.2.17",
       "dev": true,
       "inBundle": true,
       "license": "MIT",
@@ -12380,7 +12355,7 @@
       }
     },
     "node_modules/npm/node_modules/undici": {
-      "version": "6.25.0",
+      "version": "6.27.0",
       "dev": true,
       "inBundle": true,
       "license": "MIT",
@@ -13158,10 +13133,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.16",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.16.tgz",
-      "integrity": "sha512-vuwillviilfKZsg0VGj5R/YwwcHx4SLsIOI/7K6mQkWx+l5cUHTjj5g0AasTBcyXsbfTgrwsUNmVUb5xVwyPwg==",
-      "devOptional": true,
+      "version": "8.5.17",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.17.tgz",
+      "integrity": "sha512-J7EF+8X+CzRPaJPOv9Ck2wNWJvGnnl3PcNPAdGg6GTLjyVpyQ0yATMSXRFRV01BviT/9Gwuc3rjEyJbDJG9a4w==",
       "funding": [
         {
           "type": "opencollective",
diff --git a/package.json b/package.json
index 220cd48..81d2830 100644
--- a/package.json
+++ b/package.json
@@ -91,6 +91,7 @@
   },
   "overrides": {
     "undici": "^8.7.0",
-    "vite": "^8.1.4"
+    "vite": "^8.1.4",
+    "postcss": "^8.5.10"
   }
 }