build(deps): consolidate safe JS dependency bumps (round 2)

[mattwoberts]

Second consolidation round — batches the low-risk Dependabot JS updates that were failing CI individually (all hit the lockfile optional-peer pruning issue) into one branch/CI run.

Included

Direct (package.json) — supersedes #1613

• dompurify 3.4.11 → 3.4.12
• prosemirror-markdown 1.13.4 → 1.13.5
• webpack 5.108.3 → 5.108.4

Transitive (via npm update)

• svgo 2.8.0 → 2.8.3 — supersedes build(deps-dev): bump svgo from 2.8.0 to 2.8.3 #1611
• ws 8.18.0 → 8.21.0 (+ 7.5.10 → 7.5.11) — remote memory-exhaustion DoS fix — supersedes build(deps): bump ws #1614

Lockfile regenerated from main so the firm ts-node and pinned nested typescript@5.9.3 survive (dependabot's own lockfiles prune these and fail CI).

Deliberately excluded

• build(deps): bump the minor-updates group across 1 directory with 3 updates #1612 minor-updates group: tiptap-markdown 0.9 (needs Tiptap v3), @lingui/* 5.9.5 (breaks build under pinned typescript@4.6.4), @playwright/test 1.61 (times out Cucumber e2e)
• build(deps-dev): bump purgecss-webpack-plugin from 4.1.3 to 8.0.0 #1595 purgecss 4→8, build(deps): bump the all-updates group across 1 directory with 7 updates #1518 go all-updates, Bump node from 22-bookworm to 25-bookworm #1434 node 22→25 — handled separately

Local validation

• make lint-ui (0 errors), make build-ui (webpack 5.108.4), make test-ui (127 tests) ✅
• npm ci --dry-run clean; ts-node + nested typescript intact

🤖 Generated with Claude Code