fix: harden spreadsheet parsing and update SheetJS

[brycejohnson1417]

Problem and outcome

The registry version of SheetJS has known security advisories. Switch to the maintainer's pinned 0.20.3 distribution with lockfile integrity, keeping existing workbook and proposal-report behavior. Official installation source: https://docs.sheetjs.com/docs/getting-started/installation/nodejs/

Closes #107.

Changes

• Check workbook extension, regular-file status, 10 MB limit and Excel file signature before parsing.
• Bound parsed sheets to 50,000 rows and 256 columns; reject oversized ranges instead of silently truncating.
• Extract existing CSV/JSON proposal parsing into a focused helper with a 2 MB text limit.
• Preserve required tab coverage, workbook samples and CSV formatting.

Validation

RED: unsupported type, oversized workbook and disguised text regression cases failed before implementation. GREEN: nine focused cases including valid workbook coverage, quoted commas, Unicode, leading-zero identifiers, prices, JSON and excessive columns.
Clean npm ci and npm run verify passed on Node 22: 55 test files / 244 tests, lint, types, Prisma validation, production build. git diff --check passed.
Fresh npm audit no longer reports xlsx. Remaining findings: four high entries in the Prisma tooling chain and one low esbuild development advisory, tracked separately in #197. No claim of an advisory-free dependency tree.

Scope / risk

Eight files including SESSION. Existing adapter behavior retained; no UI, schema, external writes, or provider changes. Size/range checks are safeguards, not a sandbox for arbitrary hostile archives. Direct official tarball requires CDN availability on a cold install; lockfile integrity pins its content. Reviewed #135 file list and other active cleanup PRs for overlap. Later dependency changes must build on this lockfile.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
picc-push	Ready	Preview	Sep 29, 2026 6:05pm UTC

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-09-29T18:03:44.116947Z	125cf02	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[brycejohnson1417]

Merged after refreshed-main validation (56 files / 248 tests) and green CI. Production deployment dpl_AcZveJyoHdnCFb77RfKCb9YBUrtA is READY, aliased to https://piccnewyork.org at 5feada8. Production browser sign-in returns 200 with Google sign-in visible. Parser functionality was verified locally with representative workbook/CSV fixtures; no customer data was uploaded or changed. Remaining tooling advisories are addressed separately in #198.