fix(security): CVE and Scorecard alert remediation

[SafetyMP]

Summary

• Override remaining lockfile CVEs (mysql2, hono, @hono/node-server, fast-uri, browserslist, brace-expansion) without churning already-patched next-auth / @auth/core / js-yaml.
• Pin node:22-alpine and postgres:16-alpine to resolved registry digests; move GitHub token writes onto the jobs that need them.

Closes Dependabot alerts:

• chore(deps): bump react-dom from 19.2.7 to 19.2.8 #42 mysql2 (GHSA-3f6p-5ww8-9rcr) → 3.24.3
• chore(deps): bump the prisma group across 1 directory with 3 updates #34, chore(deps): bump the actions group with 2 updates #33, chore(harness): corp-site overlay sync (psa) #32 hono (incl. CVE-2026-71850 / GHSA-f23p-vx2j-j53r) → 4.12.34
• chore(deps): bump @tanstack/react-query from 5.101.2 to 5.101.4 #40, docs: polish repository for OSS best practices #1 @hono/node-server (path traversal / slash bypass) → 1.19.17
• chore(deps): bump lucide-react from 1.27.0 to 1.30.0 #47, chore(deps-dev): bump the playwright group across 1 directory with 2 updates #46, chore: scrub personal contact email and home paths #44, chore(deps): bump react from 19.2.7 to 19.2.8 #43, chore(deps): bump lucide-react from 1.23.0 to 1.25.0 #30, chore(deps-dev): bump vitest from 4.1.9 to 4.1.10 #4 fast-uri (CVE-2026-76172 / 18446 / 16221) → 3.1.7
• security: encrypt accounting OAuth tokens at rest #13 brace-expansion (CVE-2026-13149) → 1.1.18 (5.x → 5.0.9)
• chore(deps-dev): bump tsx from 4.23.1 to 4.23.10 #48 browserslist (CVE-2026-73088) → 4.28.9

Closes code-scanning alerts:

• chore(deps): bump actions/setup-node from 4 to 6 #2 TokenPermissionsID (codeql.yml: default contents: read; security-events: write on the analyze job)
• chore(deps): bump actions/checkout from 4 to 7 #3 TokenPermissionsID (release.yml: default contents: read; packages: write only on publish-docker)
• chore(deps): bump the actions group across 1 directory with 4 updates #22, chore(deps-dev): bump @eslint/eslintrc from 3.3.5 to 3.3.6 #23, chore(deps-dev): bump eslint from 9.39.4 to 9.39.5 #24, chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 #25 PinnedDependenciesID (Dockerfile node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32)

Skipped (org/process Scorecard; not in-repo):

• chore(deps-dev): bump @tailwindcss/postcss from 4.3.2 to 4.3.3 #29 FuzzingID, chore(deps-dev): bump tailwindcss from 4.3.2 to 4.3.3 #28 CIIBestPracticesID, chore(deps): bump the actions group across 1 directory with 5 updates #27 MaintainedID, chore(deps): bump lucide-react from 1.23.0 to 1.24.0 #26 CodeReviewID
• chore(deps): bump react-hook-form from 7.81.0 to 7.82.0 #31 VulnerabilitiesID (expected to clear after Dependabot is clean; Prisma-pinned valibot / deepmerge-ts remain and were not force-overridden)

Already patched on main (no churn): next-auth 5.0.0-beta.32, @auth/core 0.41.3, js-yaml 4.3.2.

Test plan

• scripts/harness/verify.sh — exit 0 (lint, typecheck, 12 files / 55 tests, boundaries, prisma validate, threat-model)
• CI verify + e2e on this PR
• Confirm Dependabot/code-scanning alerts above auto-close after merge

Made with Cursor