chore(security): temporarily accept unreleased braces advisory

[david-developer]

Current main 4be422da58e1d4d03b5c0f6079ded11079603897 is red: Checks 37236836981 failed at dependency audit after the braces advisory surfaced following PR #23's branch CI. This draft adds a second temporary risk acceptance for GHSA-vfj7-8cjw-p6xm / CVE-2026-93687, braces@3.0.3; the existing node-forge acceptance remains. Vulnerabilities fixed: NO. Temporarily accepted: two exact GHSAs.

On 2026-10-05, GitHub's advisory still reports affected <=3.0.3, no patched release, HIGH/CVSS v4 8.7. npm latest is 3.0.3; upstream fix PRs #72/#75 are open. No released compatible update eliminating all React Native/Jest/Metro and shared ESLint paths was found. No package or lockfile changes, forks or unreleased commits are used.

The low audit threshold and deterministic exact ignore set remain guarded. The guard now uses two explicit records and checks each record's own CVE/package/version, required metadata, valid deadline and maximum 14-day review window. Both deadlines remain 2026-10-16; node-forge's deadline is not extended. Remove braces acceptance on a patched release or compatible parent update removing all vulnerable paths, then rerun unfiltered audit/mobile exports/full CI.

API/web/admin/worker production dependency queries have no braces path; shared development lint tooling does. Mobile's production dependency graph includes React Native Babel/Jest and Metro/Expo tooling. Direct source imports were absent, web/admin Next traces had no braces entries, and mobile bundle marker checks did not identify package code; these do not prove every runtime/attacker-input path is absent.

Validation: 20/20 audit guard tests, 25/25 startup tests, secrets, contracts (49 routes/37 schemas), fresh uncached workspace lint/typecheck/tests/build and diff check pass. Explicit mobile lint/typecheck pass; mobile test command has zero files; Expo web/Android/iOS export passes. Configured audit passes with two ignored HIGH findings; the unfiltered audit still has those two and zero other findings at any severity. Fresh push and pull-request Checks on final head a45b7a7f62c10f5e0409b8d8295461533dc9f548 both PASSED, with no skipped gates: push 37238305270 and pull request 37238309686. Each passed secrets, guarded audit, contracts, clean isolated migrations, DB integration 22/22, API integration 7/7, lint, typecheck, workspace tests, full build/mobile exports, web Chromium 11/11 and admin Chromium 7/7. The engineering handoff records implementation-head evidence and links the live final-head checks.

Scope is five policy/guard/test/documentation files. PR #22 remains untouched, G2 remains NOT RUN, and local main remains unchanged. Leave this PR draft/open/unmerged. Main is not restored until review, merge and successful exact-main Checks. No deployment.

Branch: chore/braces-audit-exception. Exact base: 4be422da58e1d4d03b5c0f6079ded11079603897. Final head: a45b7a7f62c10f5e0409b8d8295461533dc9f548. CI is complete; security/risk-acceptance review remains outstanding. This PR stays draft/open/unmerged.