chore(deps): refresh lockfile within existing ranges

[thewrz]

This was written agentically; verify its assertions and edit accordingly:

Why

#127 put both routine dependency PRs into conflict — #131 (Dependabot's npm minor/patch group) and the npm half of #128 (Renovate). Rather than run a rebase round-trip against branches Dependabot auto-closes on external pushes, this lands the same bumps directly and deterministically.

What

Lockfile only — server/package.json is untouched. Every change is a version the existing caret ranges already authorized, so this is a re-resolution, not a policy change. The Node pin is unaffected: @types/node stays 24.13.3, engines.node stays ">=24 <25", and check:node-pin passes.

Notable direct bumps:

Package	Change
fastify	5.8.5 → 5.11.0
@fastify/cors	11.2.0 → 11.3.0
@fastify/helmet	13.0.2 → 13.1.0
better-sqlite3	12.10.0 → 12.11.1
bonjour-service	1.3.0 → 1.4.4
@playwright/test	1.60.0 → 1.62.1
vitest, @vitest/coverage-v8	4.1.6 → 4.1.10
fast-check	4.8.0 → 4.9.0
tsx	4.22.4 → 4.23.1

Three entries that look alarming in the diff

100 packages moved, which is wider than the direct list. Three deserve a callout — each was traced before committing, and all are upstream decisions reached through in-range bumps, not choices made here:

• @emnapi/core 1.11.1 → 2.0.0-alpha.3 — an alpha, but pinned exactly by @rolldown/binding-wasm32-wasi ("@emnapi/core": "2.0.0-alpha.3"). It is an optional wasm32-wasi platform binding, not installed or loaded on the platforms this project builds for.
• fastify-plugin 5.1.0 → 6.0.0 and fast-json-stringify 6.3.0 → 7.0.1 — transitive majors, required at ^6.0.0 / ^7.0.0 by @fastify/cors, @fastify/helmet, @fastify/static and fastify itself after their minor bumps.
• fsevents 2.3.3 → 2.3.2 — a downgrade, but fsevents is a darwin-only optional dependency pinned exactly elsewhere in the tree.

Testing

Verified in a real node:24 container. Because fastify moved three minors and fastify-plugin went major, this was booted, not just unit-tested:

• npm ci — clean, lockfile in sync
• npm run check:node-pin — consistent, Node 24 across 4 declarations
• npm run typecheck and npm run typecheck:scripts — exit 0
• npm run build — exit 0
• npm audit --audit-level=high — 0 vulnerabilities
• 1670 tests pass, 11 skipped, 106 files
• Server boots with no plugin-registration errors; /, /js/app.js, /health, /fixtures all 200; path traversal still 404
• CI green

Supersedes

Closes the npm side of the bot backlog: #131 and the npm portion of #128 (already closed). #123/#137 (GitHub Actions bumps) are separate and not covered here.

🤖 Co-authored by Claude Opus 5 (1M context).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0a79746d-ce49-4d5f-86a3-aeff8deba3ff

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}