fix(deps): rerun npm audit fix and clarify checklist note

- Re-ran npm audit fix on top of the merged main; lockfile now reflects
  the latest auto-fix state (still 3 vulnerabilities: vite via
  dependabot #75, pm2 ReDoS no upstream fix, request SSRF requires
  breaking fs-js-lite upgrade).
- PLAN.md: rewrite the resolved checklist note to make the partial-fix
  state unambiguous — explicitly call out which vulnerabilities are
  fixed and which are risk-accepted, addressing the Copilot review
  comment about the inconsistent 'fixed but unfixed' wording.

Author: atomantic