clear 8 advisories, lockfile only

[akagabi]

Closes #1.

npm audit fix --package-lock-only. 14 advisories → 6, clearing the critical
and 5 of 11 highs. package.json is byte-identical.

What is left, and why it matters less than the number suggests

All 6 remaining are in metro, image-size and
@react-native/community-cli-plugin — the React Native build toolchain.

react-native here is a devDependency (^0.83.1) and a peerDependency
(>=0.70). It is not a runtime dependency of this package, so none of these
reach anyone installing @detail-co/morph-text-native — a consuming app brings
its own React Native and its own metro. This is bundler tooling in this repo's
node_modules, not shipped code.

Clearing them means moving react-native itself, which npm audit fix will only
do with --force. Not worth it for dev-only advisories in a library with no tests.

Verification

check	result
package.json unchanged	byte-identical
npm ci from the new lockfile	clean
npm run build (tsc)	clean
npm run typecheck (tsc --noEmit)	clean

No test run — this repo has no test script and no specs.

Note: node -e "require('./dist/index.js')" fails with ERR_MODULE_NOT_FOUND on
./MorphText, because the compiled output uses extensionless ESM imports. That is
pre-existing and unrelated — Metro resolves them, plain Node does not. Flagging
it because it is a real packaging wrinkle worth fixing one day, not because this PR
touched it.

How to check this

This is a published library, not a deployed service, so there is no staging to
watch. The equivalent proof is a consuming build:

1. Build an app that depends on it and confirm Metro bundles without a
   resolution error. That exercises the toolchain the remaining advisories live in.
2. Render MorphText once and confirm the animation runs — the whole surface
   of this package is one component.
3. Do not publish from this PR. It changes no runtime dependency and no
   version, so there is nothing for consumers to pick up; a release would be noise.