Clear the outstanding npm audit advisories: fast-uri, qs (root) and browserslist (tui)

[cliffhall]

npm install at the repo root currently leaves npm audit non-clean. Three
advisories are outstanding across the install cascade, all transitive, none
directly declared by us.

What's reported

Package	Sev	Install	Path	Vulnerable	Fixed in
fast-uri	high	root	ajv@8.18.0 → fast-uri@3.1.5	>=3.0.0 <3.1.6	3.1.6
qs	moderate	root	express@5.2.1 → qs@6.15.3 (also via body-parser)	>=2.2.5 <6.16.0	6.16.0
browserslist	high	clients/tui	eslint-plugin-react-hooks@7.1.1 → @babel/core → browserslist@4.28.2	<=4.28.6	4.28.7+ (latest 4.28.9)

Advisories:

• fast-uri — four separate ones: GHSA-5jgf-p345-68v8 (host confusion via skipped IDN canonicalization), GHSA-f65p-4m7j-42xc (SSRF via malformed IPv6 normalization), GHSA-fph4-wmhf-6fwf (SSRF via repeated hostname percent-decoding), GHSA-jqff-g426-hqxp (host confusion via percent-encoded scheme normalization)
• qs — GHSA-x5fp-wj9c-mxmx (array-limit bypass via bracket-key comma parsing), GHSA-4mjr-xmp4-gh2g (DoS via attacker-controlled isBuffer)
• browserslist — GHSA-c83g-rgw3-j3cx (unbounded cache growth → OOM), GHSA-73wf-gq98-2v4g (uncaught crash / prototype write via untrusted browserslist-stats.json)

Reachability — needs confirming, not assumed

Part of the work here is establishing exposure rather than pinning on the
advisory alone. Initial read:

• fast-uri is the one that plausibly ships. ajv is a root runtime
  dependency that core/json uses to validate schemas coming from the server
  under test, and fast-uri is what ajv resolves $id/$ref URIs with — so
  the input is attacker-influenced. What is not established is whether any of
  these four advisories is exercisable through that path (none of them makes
  ajv perform a network fetch). Confirm before treating this as user-facing.
• qs looks dev/transitive only. express is a root devDependency and
  otherwise arrives under the SDK packages; the web backend is Hono, not
  express. If nothing shipped parses a query string through qs, this is
  hygiene rather than exposure — worth writing down either way.
• browserslist is dev tooling, reached only through tui's ESLint plugin.
  Not in any published bundle.

Proposed fix

overrides at the repo root, per the AGENTS.md rule that a transitive is
pinned with an overrides entry and never with npm audit fix (which
resolves an advisory with no upward escape by silently downgrading).

Candidate pins — semver-checked but not yet installed or gate-verified:

"overrides": {
  "fast-uri": "^3.1.6",   // ajv@8.18.0 wants ^3.0.1, so ^3.1.6 is compatible
  "qs": "^6.16.0"
}

fast-uri@4.x exists but is outside ajv's range, so the pin stays on 3.x.
The browserslist copy lives in the clients/tui install, so it needs
either its own override there or a bump of eslint-plugin-react-hooks — decide
which once reachability is written up.

Acceptance

• Reachability assessed and recorded for each of the three
• npm audit clean at the root and in all four client installs
• npm run local:gate passes
• No package moved between manifests, and no client re-declares a root-owned package

Note on overlap

#2233 / #2243 just landed a workflow that consumes Dependabot alerts into
board-tracked issues. These three may well be re-reported by that sweep — if so,
close whichever is the duplicate rather than fixing both.

[cliffhall]

Triage: Priority Medium (total 6)

• Severity 3 — three real advisories, but no exploit path is established yet. The one that plausibly reaches shipped code (fast-uri, behind ajv in core/json) does not make ajv fetch anything; qs and browserslist look dev/transitive only. Re-score up if reachability is confirmed.
• Urgency 3 — wanted this milestone: npm audit is non-clean on a fresh root install, which is release hygiene.
• Bonuses: none. Not a bug label (this is chore), no engagement, unassigned, not a sub-issue, no reporter-set Fields → Priority. The milestone bonus is deliberately not claimed — this was filed through the /issue-create flow, where a milestone is set on every issue by rule, so it would be a constant that discriminates nothing.

Board: #28, Status Todo, milestone v2.6.0 — filing it through the create flow is the approval, so it skips Incoming.