fix(security): resolve all dependency vulnerabilities across the stack

[BillyOutlast]

Summary

Resolves every known dependency vulnerability across the monorepo: pnpm audit 84 findings → 0, cargo audit 28 findings → 0 across all 7 crates, govulncheck 1 → 0.

pnpm workspace

• server/: Prisma 7.7.0 → 7.10.0
• desktop/main/: koa 2.16.1 → 3.2.1, markdown-it → 14.3.0 (fixes linkify-it ≤5.0.1), sass-embedded → ^1.103.1 (fixes immutable), with brace-expansion, minimatch, and nanoid deep-updated to patched versions
• Root pnpm-lock.yaml refreshed; overrides updated for transitive advisory coverage

Rust crates

cargo update applied to all seven independent lockfiles (cli, torrential, desktop/src-tauri, libraries/{droplet,droplet_types,libarchive,native_model}).

Go backend

stdlib module updates in go.work.sum resolving the single govulncheck finding.

Notes for review

The lockfile diffs are large but mechanical — no source code changes. One caveat: the root manifest gains devDependencies (lefthook, knip, @ast-grep/cli, prettier) that a companion tooling PR introduces; they're included here so the root install stays consistent. If you'd prefer this split differently, happy to rework.

Verification

$ pnpm audit          # run in each of: ., server/, desktop/main/, sites/docs/, sites/promo/, libraries/base/
No known vulnerabilities found
$ cargo audit         # in each of the 7 crate dirs
Success No vulnerable packages found
$ govulncheck ./...
No vulnerabilities found.

[DecDuck]

Looks like lint and typecheck failed for this