Address critical npm vulnerabilities in builder-frontend

[prestoncabe]

Problem

Installing builder-frontend dependencies currently reports 22 known vulnerabilities:

• 1 low
• 4 moderate
• 12 high
• 5 critical

The critical vulnerabilities should be identified and remediated without applying unreviewed breaking dependency upgrades.

Reproduction

cd builder-frontend
npm install
npm audit

Acceptance criteria

• Run npm audit and document the packages and dependency paths responsible for all 5 critical findings.
• Update direct dependencies, transitive dependencies, or narrowly scoped overrides as appropriate.
• npm audit reports zero critical vulnerabilities, or any finding that cannot be fixed is documented with its exposure, mitigation, and a follow-up issue.
• Commit the resulting builder-frontend/package-lock.json changes.
• npm test passes in builder-frontend.
• npm run build passes in builder-frontend.
• Review high, moderate, and low findings and create follow-up issues where they are not resolved by the same dependency updates.

Notes

Do not run npm audit fix --force without reviewing the proposed major-version changes and testing their compatibility.