Fix dependency audit findings, lint errors, and contact move authorization

[jhilly20]

Summary

This PR applies the completed technical-review fixes from the fork:

• Fixes dependency audit findings by updating the Go toolchain target, refreshing affected golang.org/x/* modules, and adding Bun overrides for vulnerable frontend transitive dependencies.
• Fixes preexisting frontend ESLint errors in auth/vault settings pages so lint can run cleanly.
• Hardens contact move authorization by preventing cross-account moves, blocking shadow/self-contact moves, requiring Editor-or-better permission on the target vault, and asserting database persistence.

Verification

• govulncheck ./... reports 0 called vulnerabilities.
• bun audit reports 0 vulnerabilities.
• make build-server passes.
• make build-web passes.
• make lint passes.
• make test passes.
• Focused contact-move service and handler authorization tests pass.

Security notes for maintainer review

A higher-severity relationship IDOR concern was found during the authorization audit but intentionally left for separate maintainer review:

• Relationship create/update appears to accept related_contact_id values that are validated as existing contacts, but should also be explicitly checked against vaults the user can access.
• I did not modify relationship behavior in this PR because it touches broader relationship semantics.

Contact-move child-data semantics were also intentionally left unchanged:

• Moving a contact updates the contact's vault_id.
• Some related child records follow naturally through contact_id.
• Other related records are independently vault-scoped and retain their existing vault_id.
• Maintainers should decide whether moves should cascade, clone/remap, or be blocked when vault-scoped child data exists.

Fork PR context

These changes were reviewed separately in the fork before combining upstream:

• Dependency/security fixes: Fix dependency audit findings Kindred-app-social/bonds#1
• Frontend lint fixes: Fix frontend lint errors Kindred-app-social/bonds#3
• Authorization audit fix: Audit API authorization and restrict contact moves Kindred-app-social/bonds#4

[naiba]

This PR currently has merge conflicts against main. GitHub reports mergeable=CONFLICTING and mergeStateStatus=DIRTY. Please rebase or merge the latest main and resolve the conflicts before further review.