fix(deps): bump brace-expansion and fast-uri overrides for audit

[WhiteMuush]

Why

The Security workflow is failing on main (and therefore blocking dependabot PR #131) with two high severity advisories:

• brace-expansion: the existing ^5.0.8 override no longer covers GHSA-rgw5-rvv9-x895, whose vulnerable range is 4.0.0 - 5.0.8. Fixed in 5.0.9.
• fast-uri: GHSA-7p8r-x3mc-p8w7 affects 3.0.0 - 3.1.4. There was no override for it, so the transitive 3.1.4 was being pulled in. Fixed in 3.1.5.

What

Bumps the brace-expansion override to ^5.0.9 and adds a fast-uri override at ^3.1.5. The lockfile only moves those two packages.

Verification

npm audit --audit-level=high
found 0 vulnerabilities

Lint and type-check pass via the pre-commit and pre-push hooks.

Follow-up

Once this lands, dependabot PR #131 should go green without any change on its side, since its only failing check was this same audit.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UP1g9VaCLgZ1nCfRjNBcZW