CI audit gate red: fix high npm advisories (brace-expansion root + sharp in collab-server)

[ipapakonstantinou]

npm audit --audit-level=high fails on BOTH CI jobs (root "Lint·Typecheck·Test·Build" and "Collab server"). Surfaced on dev after integrating #217, but it is repo-wide — main would fail too now (advisory DB moved ~2026-07-22; main's last green run was 2026-07-21). Feature code is fine: lint / typecheck / test / build all pass on dev; only the audit step is red.

Do this on the personal dev box (the work laptop's corporate TLS proxy blocks npm installs, so it could not be done there).

1. Root — brace-expansion (GHSA-3jxr-9vmj-r5cp) — non-breaking

• Advisory range widened to <1.1.16 || >=3.0.0 <5.0.7. Lockfile currently resolves 1.1.14 and 5.0.6 — both now vulnerable.
• Fix: npm audit fix (bumps to >=1.1.16 / >=5.0.7). Then npm audit --audit-level=high must be clean.

2. collab-server — sharp via miniflare → wrangler (GHSA-f88m-g3jw-g9cj) — breaking

• cd collab-server. Vulnerable libvips in sharp <0.35.0, pulled transitively by miniflare (a wrangler dep).
• npm audit fix --force proposes a wrangler major — verify it does not break the Worker build/deploy. Cross-check open Dependabot PR chore(deps-dev): bump wrangler from 4.110.0 to 4.113.0 in /collab-server #256 (wrangler 4.110→4.112): a newer wrangler/miniflare may already ship patched sharp and avoid a forced change.
• Then npm audit --audit-level=high in collab-server must be clean.

3. Land + promote

• Commit the lockfile change(s) to dev, push, confirm CI green.
• Promote dev → main (prod) — Jon's call.

Notes

• Dependabot alert Competitor research: StackEdit (+ HackMD/CodiMD) #85 (brace-expansion) is OPEN; it auto-closes once step 1 lands on the default branch.
• dev = main + Add Codeberg / Forgejo / Gitea as vault hosts (host-picker connect flow) #217 merge (commit 356e27b). Add Codeberg / Forgejo / Gitea as vault hosts (host-picker connect flow) #217 (fork by @rotecodefraktion) is fully integrated and the contributor is not needed for promotion.
• Context: raised while triaging CI from the work laptop; deps deferred here on purpose.

[thetechjon]

Fixed on dev: #268 (brace-expansion + js-yaml + sharp overrides, root and collab-server) and #270 (next 15.5.21). CI audit gate is green.