fix: remove production dependency vulnerabilities

[typefield]

Summary

• upgrade axios from ^1.4.0 to ^1.19.0
• upgrade ws from ^8.13.0 to ^8.21.1
• refresh the lockfile to pick up safe transitive versions, including follow-redirects@1.16.0 and form-data@4.0.6
• synchronize the existing nock dev dependency into the lockfile so a clean npm ci works from main

Why

The current production lockfile reports 1 critical, 2 high, and 1 moderate vulnerability via npm audit --omit=dev. The affected paths are rooted in the direct axios and ws dependencies.

After this update, npm audit --omit=dev reports 0 vulnerabilities. Both direct dependencies remain within their existing major versions.

Validation

• npm ci --registry=https://registry.npmjs.org
• npm run typecheck
• Node 18 and Node 20: build and all 7 reconnect regression assertions
• Node 22 and Node 24: all 7 reconnect runtime assertions
• npm pack --dry-run
• npm audit --omit=dev --registry=https://registry.npmjs.org --audit-level=low (0 vulnerabilities)

Relationship to #20

This PR starts from the current main branch to keep the dependency security update separate from #20. Both PRs update package-lock.json, so the second PR merged should refresh its lockfile against the new base.

[wxianfeng]

事后 CR 结论：LGTM，未发现阻断项或需要立即补救的合并后问题。

PR 已在评审前合并为 246dceb；本次核对 PR head 1079e38，实际依赖升级提交为 da5d2e6。审查范围确认仅包含 package.json / package-lock.json：

• axios：1.5.0 → 1.19.0
• ws：8.14.1 → 8.21.1
• 安全传递依赖更新到 follow-redirects@1.16.0、form-data@4.0.6、proxy-from-env@2.1.0 等
• 两个直接依赖保持原 major，生产依赖的 Node engine 下限未超出现有支持范围
• 锁文件与依赖声明一致，npm ci 可复现安装

本地验证（macOS / Node 22.15.0 / npm 11.5.2）：

• npm ci、npm run typecheck 通过
• lifecycle 与 reconnect 测试全部通过（重连断言 7/7）
• npm pack --dry-run 通过
• npm audit --omit=dev --audit-level=low：0 vulnerabilities

GitHub CI：6/6 通过。

非阻断说明：不带 --omit=dev 的全量 audit 仍报告 11 项开发依赖漏洞（1 low、2 moderate、8 high），不影响本 PR 清零生产依赖漏洞的目标，可随构建工具链升级另行处理。