Investigate API transitive dependency advisories without framework downgrades

[nihey]

The API production audit currently reports eight high-severity transitive advisories. The automatic npm fix suggestions include incompatible NestJS framework downgrades and must not be accepted.

Acceptance criteria:

• Map every advisory to its exact dependency path and actual runtime reachability.
• Prefer compatible parent upgrades, narrowly scoped overrides, or upstream fixes; do not use forceful audit fixes.
• Run the API clean install, lint, typecheck, unit tests, end-to-end tests, production image build, and image smoke check.
• If any advisory maps to an exploitable production path, stop public discussion of the exploit details and use the repository private vulnerability-reporting channel.
• Document safe residual risk where no compatible fix exists.