chore(deps): refresh npm locks to clear audit advisories

[EvilHumphrey]

Summary

Refresh npm lockfiles to clear current npm audit advisories across the root workspace, website, and WhatsApp bridge dependency trees.

Changed files are lockfile-only:

• package-lock.json
• website/package-lock.json
• scripts/whatsapp-bridge/package-lock.json

Audit impact

Before this lockfile refresh:

• root npm audit: 2 high vulnerabilities
• website npm audit: 9 vulnerabilities (3 high, 6 moderate)
• scripts/whatsapp-bridge npm audit: 4 moderate vulnerabilities

After this lockfile refresh:

• root npm audit: 0 vulnerabilities
• website npm audit: 0 vulnerabilities
• scripts/whatsapp-bridge npm audit: 0 vulnerabilities

The refreshed transitive/package versions include fixes around react-router, react-router-dom, express / body-parser, qs, ws, protobufjs, path-to-regexp, picomatch, postcss, brace-expansion, and undici.

Verification

Sanity/privacy check:

• commit diff is limited to the three package-lock files above
• checked the diff body for personal paths, tokens, secrets, and credential-like strings; no matches found
• commit metadata uses the GitHub noreply address associated with the fork account

Commands run locally:

hermes doctor
npm audit
(cd website && npm audit)
(cd scripts/whatsapp-bridge && npm audit)
npm -w web run build
npm -w apps/desktop run type-check

Results:

• hermes doctor: passed
• root npm audit: found 0 vulnerabilities
• website npm audit: found 0 vulnerabilities
• scripts/whatsapp-bridge npm audit: found 0 vulnerabilities
• npm -w web run build: passed
• npm -w apps/desktop run type-check: passed

Note: existing web lint debt is intentionally not included in this PR; this is a narrow lockfile-only audit cleanup.

[EvilHumphrey]

Closing in favor of cleaner replacements off current main:

• Website + whatsapp-bridge audit advisories (the standalone, non-Nix lockfiles) → chore(deps): clear npm audit advisories in website + whatsapp-bridge lockfiles #39450 — clears 13 of the 15 findings (incl. 3 high), with no nix/lib.nix npmDepsHash dependency.
• OSV scanner coverage for the whatsapp-bridge lockfile → ci(osv): scan all tracked first-party lockfiles #39452.
• The root package-lock.json react-router advisory (the only Nix-coupled surface) needs a nix/lib.nix npmDepsHash recompute. The auto-fix workflow that should handle that is currently broken — tracked in nix-lockfile-fix.yml can never commit its hash update — stages nix/tui.nix + nix/web.nix, but fix-lockfiles writes nix/lib.nix #39455.

This PR had become conflicted against main and bundled the Nix-coupled root lock together with the standalone locks, forcing the whole change to wait on the Nix step. Splitting it for reviewability.