Fix multipart runtime advisories

[LQ458]

Summary

• upgrade Multer from the deprecated 1.x line to the patched 2.2.0 release
• retain the existing storage, field, file-count, type, and size constraints
• update the dependency status and changelog with the verified runtime-advisory reason
• normalize both npm lockfiles to the official npm registry

Verification

• npm ci --registry=https://registry.npmjs.org
• focused multipart/auth/media tests: 13 passed
• npm run verify: 39 backend tests, 20 frontend tests, strict lint, and production build passed
• root full and production audits: zero known advisories
• client production audit: zero known advisories; the documented CRA development tree remains unchanged

Boundaries

• no API, database, media, Nginx, or production-service changes
• no deployment is included