chore: refresh audit transitive dependencies

[corwinm]

Summary

• Refreshes package-lock.json with npm audit fixes for vulnerable transitive dependencies.
• Keeps the change scoped to lockfile resolution only; no direct dependency ranges or package source files changed.
• Clears advisories across the Pi dependency tree including basic-ftp, fast-xml-builder, protobufjs, fast-xml-parser, @protobufjs/utf8, brace-expansion, ip-address, ws, and @aws-sdk/xml-builder.

Security notes

Before this PR, npm audit reported 9 vulnerabilities:

• 3 high
• 6 moderate

After the lockfile refresh, npm audit reports zero vulnerabilities.

Notable resolved transitive versions include:

• basic-ftp 5.3.0 → 5.3.1
• fast-xml-builder 1.1.5 → 1.2.0
• fast-xml-parser 5.5.8 → 5.7.3
• protobufjs 7.5.5 → 7.6.4
• @protobufjs/utf8 1.1.0 → 1.1.1
• brace-expansion 5.0.5 → 5.0.6
• ip-address 10.1.0 → 10.2.0
• ws 8.20.0 → 8.21.0
• @aws-sdk/xml-builder 3.972.18 → 3.972.29

Test plan

• npm audit --json → zero vulnerabilities (info: 0, low: 0, moderate: 0, high: 0, critical: 0, total: 0)
• npm run typecheck
• npm run test → 54 tests passed
• npm run pack:all