Dependency & lockfile hygiene: clear medium/low Dependabot, regenerate lockfiles, fix broken/unpinned deps

[jhamon]

Theme: Dependency Hygiene + Cleanup (Themes 2 & 4)

Problem

The repo has 53 open Dependabot alerts spread across every app and manifest. The 2 critical + 11 high alerts are handled by the separate Security fast-track (see parent). This issue covers the remaining medium/low alerts plus lockfile regeneration and several concrete dependency-hygiene defects found during the audit:

Dependabot distribution (medium/low tail owned here):

• namespace-notes/server/package-lock.json: 6 medium, 4 low
• legal-semantic-search/package-lock.json: 6 medium
• namespace-notes/client/package-lock.json: 5 medium, 2 low
• pinecone-assistant/pnpm-lock.yaml: 4 medium, 2 low
• shop-the-look/package-lock.json: 3 medium
• shop-the-look/requirements.txt: 2 medium, 1 low
• (crit/high on the same manifests → Security fast-track)

Concrete defects found in manifests:

1. legal-semantic-search has broken local file: dependencies: "openai": "file:langchain/llms/openai" and "voyage": "file:langchain/embeddings/voyage". These point at non-existent local paths and will break a clean npm install — almost certainly leftover mis-edits (LangChain re-exports, not local packages).
2. shop-the-look/requirements.txt has unpinned deps: python-multipart and Pillow have no version pin, hurting reproducibility; verify requests==2.33.0 is a real published version (looks suspicious).
3. .gitignore has a corrupted Python ignore: **pycache**/ (markdown-asterisk corruption) instead of **/__pycache__/, so __pycache__ dirs are not ignored.
4. namespace-notes/server/package.json metadata is wrong/empty: "name": "node", empty author/description, "license": "ISC" (repo is MIT), and a placeholder "test" script that just exits 1.

Proposed fix

• Run npm audit fix / targeted bumps per npm app and pip-audit for shop-the-look; regenerate each lockfile (npm install; pnpm install for pinecone-assistant) so CI installs platform-native deps.
• Remove the two bogus file: deps in legal-semantic-search and wire OpenAI/Voyage through their real packages (@langchain/openai, openai) as the code actually uses them.
• Pin python-multipart and Pillow to explicit versions; correct any invalid requests pin.
• Fix .gitignore to **/__pycache__/.
• Correct namespace-notes/server package metadata (name, description, author, license → MIT to match repo).

Acceptance criteria

• All medium/low Dependabot alerts cleared; lockfiles regenerated and committed.
• npm install (and pnpm install) succeed cleanly in every app from a fresh checkout; the file: deps are gone.
• Python deps pinned; .gitignore fixed; server metadata accurate.

Blast radius

needs-verification — dependency bumps and the file: dep removal can shift install/build behavior; verify each app installs and builds.

Dependencies

Depends on #71 (CI safety net) to verify installs/builds across all apps after regeneration.