build(deps): consolidate safe dependency bumps

[mattwoberts]

Consolidates several low-risk Dependabot updates into one branch/CI run instead of merging each PR individually (branch protection requires up-to-date branches, so serial cleanup is slow).

Included

Go

• golang.org/x/crypto 0.48.0 → 0.52.0 — supersedes build(deps): bump golang.org/x/crypto from 0.48.0 to 0.52.0 #1609
• golang.org/x/image 0.38.0 → 0.41.0 — supersedes build(deps): bump golang.org/x/image from 0.38.0 to 0.41.0 #1608
• golang.org/x/net 0.50.0 → 0.55.0 — supersedes build(deps): bump golang.org/x/net from 0.50.0 to 0.55.0 #1599

JS

• autoprefixer (dev) 10.5.0 → 10.5.2 — supersedes build(deps-dev): bump autoprefixer from 10.5.0 to 10.5.2 in the patch-updates group #1593
• webpack 5.107.2 → 5.108.3 — cherry-picked from build(deps): bump the minor-updates group with 4 updates #1594's group

The lockfile was regenerated from main (npm install --package-lock-only) so the firm ts-node and pinned nested typescript survive — dependabot's own lockfiles prune these optional peers and fail CI.

Deliberately excluded

• build(deps): bump the minor-updates group with 4 updates #1594's other members: tiptap-markdown 0.9 (needs Tiptap v3), @lingui/macro 5.9.5 (breaks build under pinned typescript@4.6.4), @playwright/test 1.61 (times out Cucumber e2e)
• build(deps-dev): bump purgecss-webpack-plugin from 4.1.3 to 8.0.0 #1595 purgecss-webpack-plugin 4→8 (major)
• build(deps): bump the all-updates group across 1 directory with 7 updates #1518 go all-updates group (aws-sdk-go EOL, v8go native bindings)
• Bump node from 22-bookworm to 25-bookworm #1434 node 22→25 docker (major)

Local validation

• go build ./..., go vet ./app/... ✅
• make lint-ui, make build-ui (webpack 5.108.3), make test-ui (127 tests) ✅
• make test-server ✅ — all packages pass except app/pkg/web locally (dev-server port collision only; clean in CI)

🤖 Generated with Claude Code