Dependency hardening: deferred npm and pip advisories

[codethor0]

Current state

• npm audit reports known advisories, including Next.js/postcss class issues
• pip-audit has known deferred advisories documented in docs/dependency-audit.md
• No dependency upgrades should happen casually

Required approach

1. Plan dependency upgrade batch separately with full frontend/backend validation
2. Document any accepted deferred advisories with rationale
3. Do not upgrade dependencies in contributor first-PR lanes without approval

Launch impact

• Public launch should not claim dependency advisories are remediated until this issue is completed or explicitly documented as accepted risk

[codethor0]

Batch 7E classified remaining advisories: PostCSS moderate accepted deferred (build-time); host pip/wheel/loguru out of repo scope. npm high and project-pinned pip dev advisories remediated in 7B-7D. Maintainer may close this issue after accepting Batch 7E classification in docs/dependency-audit.md.