Release v2.5.1 — reverse-proxy WS-token hotfix (#988)

[realproject7]

EPIC Context

• Parent: [EPIC] QuadWork v2.4.0 hardening & quality pass — audit remediation #967 — QuadWork v2.4.0 hardening & quality pass
• Epic goal: Ship hardening fixes without regressing working deployments.
• This ticket's role: Release v2.5.1 — patch bump so the [#968 regression] Reverse-proxy dashboard locked out of terminal WS — /api/session-token 403s the proxied Host #988 reverse-proxy WS-token fix (PR [#988] Reverse-proxy dashboard token allowlist (v2.5.1 hotfix) #989) reaches users. v2.5.0 regressed live terminal access on nginx-proxied dashboards; this restores it.
• Depends on: [#968 regression] Reverse-proxy dashboard locked out of terminal WS — /api/session-token 403s the proxied Host #988 (merged) Enables: GitHub release v2.5.1 + npm publish (operator gate)
• Contracts to respect/expose: version bump only (package.json + package-lock.json), PATCH per hotfix convention
• Out of scope here: folded tickets / refactors (v2.6.0)

Scope

Bump 2.5.0 → 2.5.1 (npm version patch --no-git-tag-version). Two files.

Acceptance Criteria

• package.json version = 2.5.1, package-lock.json in sync
• No other changes
• pack-smoke + full suite (CI) pass