fix: harden dependency follow-up policies

[w0rldx]

Summary

• align the Aspire AppHost SDK and hosting package tuple on 13.5.2, including the matching Browsers servicing build, with an auto-enrolled regression contract
• remove the OpenAPI certificate-validation bypass and replace it with normal Node trust via NODE_EXTRA_CA_CERTS, including behavioral self-signed-certificate rejection coverage
• align the frontend runtime contract on Node >=22.13.0 and pin the newest naturally trust-clean Node 22 typings (@types/node 22.3.0 -> undici-types 6.18.2)
• keep unsupported @types/node major updates out of Dependabot until the runtime baseline moves, and update the existing policy contracts/docs

This safely supersedes the incomplete changes proposed by Dependabot PRs #16 and #17.

Validation

• independent code review: APPROVE (0 findings)
• independent architecture review: CLEAR
• frontend: frozen install, OpenAPI drift, license drift, validate, 2,414 coverage tests, 46 tooling tests, production build/bundle budget, production and full audits (no known vulnerabilities)
• release: 23/23 release-contract files; ShellCheck/PSScriptAnalyzer/Pester/P0 compile gate clean
• Python: full style/types/tests/security gate clean
• backend: locked restore and non-incremental Release build clean (0 warnings/errors); live OpenAPI contract clean
• backend tests: AI Agent and main test modules passed; the persistence module's one load-sensitive migration timeout under 106-way local overlap passed in isolation and the full module passed 728 executed / 1 skipped with CI-equivalent --maximum-parallel-tests 8; assembly guards were clean
• Aspire: AppHost, backend, React, SQLite, and helper container healthy; no Error/Critical OTEL logs; trusted HTTPS OpenAPI fetch passed through NODE_EXTRA_CA_CERTS; clean shutdown verified