chore(deps): remediate npm audit advisories

[soerennb]

Summary

• update compatible frontend patch/minor dependencies from the PR-71 public baseline
• resolve the js-yaml, qs, and colord audit findings in the lockfile
• keep the known dev-only elliptic advisory unchanged because no upstream fix is available

Validation

• npm ci on Node 24.11.1 / npm 11.6.2
• npm audit --audit-level=high
• npm run lint
• npm test (118 Vitest tests + 7 script tests)
• npm run build
• npm run build:docs
• composer lint, composer test (198 tests), composer analyse
• full Playwright E2E: 53 passed, 2 skipped

This branch was produced twice with the incremental public-history sanitizer; both runs yielded the same public commit and clean Gitleaks scans.