[Hollujay]

Summary

• Update the vulnerable Fastify runtime dependency resolution.
• Update both vulnerable transitive fast-uri resolutions.
• Remove all production-runtime findings reported by npm audit --omit=dev.
• Keep the dependency remediation limited to the existing package ranges.

Security findings addressed

Before this change, the production dependency tree contained:

• Fastify advisories affecting versions through 5.12.0, including a
  schema-validation issue and an X-Forwarded-* spoofing issue.
• fast-uri advisories affecting the resolved 3.x and 4.x versions in the
  production dependency tree.

After this change:

• fastify resolves to 5.12.5
• fast-uri resolves to 3.1.8 and 4.1.5
• npm audit --omit=dev reports 0 vulnerabilities

Validation

• npm audit --omit=dev — 0 vulnerabilities
• npm test — 56/56 passed
• npm run typecheck — passed
• npm run lint — passed
• git diff --check — clean

Scope

• package-lock.json only
• package.json unchanged
• no source changes
• no CI changes
• no unrelated dependency upgrades

The dev-only Vitest findings remain outside this PR's scope.