chore(deps): clear all open Dependabot alerts, refresh in-range dependencies

[HugoFara]

Clears all eight open Dependabot alerts (2 high, 6 moderate) plus two more that npm audit reports — ten advisories across five packages. Every one is fixed inside the existing version constraints, so no composer.json / package.json range edits were needed.

Security

Package	Change	Advisories
guzzlehttp/guzzle	7.12.1 → 7.15.1	5
guzzlehttp/psr7	2.12.1 → 2.13.0	1 (CVE-2026-59882)
brace-expansion	→ 5.0.8	2
linkify-it	→ 5.0.2	1
postcss	→ 8.5.23	1

The guzzle and psr7 ones are runtime, not tooling — both reach LWT through league/oauth2-google, so they affect the running application. The guzzle advisories are: proxy-authorization headers sent to origin servers, URI fragments disclosed in redirect Referer headers, unbounded response cookies, host-only cookie scope not preserved, and cookie disclosure via IP-address domains. psr7 is host confusion via weak URI host validation.

brace-expansion, linkify-it and postcss are build/test toolchain only, not shipped to users.

One deliberate constraint change

The brace-expansion override floor moves from >=5.0.6 to >=5.0.8. The lock already pinned 5.0.8 so audit was green either way, but the newer advisory covers everything up to 5.0.7 — the floor had quietly stopped guaranteeing what it was added to guarantee.

Routine refresh

All in-range: phpmailer/phpmailer 7.1.1, league/commonmark 2.8.3, thenetworg/oauth2-azure 2.2.6, phpunit/phpunit 11.5.56, plus Symfony and amphp transitives. On the JS side: vite 8.1.5, vitest 4.1.10, eslint 10.8.0, cypress 15.19.0, lucide 1.26.0, @alpinejs/csp 3.15.12, typescript-eslint 8.65.0, prettier 3.9.6, vue 3.5.40.

Held back as separate decisions: typescript 6 → 7, purgecss 4 → 8, @types/node 25 → 26. Also guzzle 8 and psr7 3, which league/oauth2-client constrains anyway.

Verification

• Psalm 0 errors
• PHPUnit 9085 pass
• Integration 157 pass, 384 assertions (matches baseline)
• Vitest 4445 pass
• typecheck, lint, build:all clean
• composer audit and npm audit both report zero

Two things worth a reviewer's attention:

lucide jumped 1.11 → 1.26, which is wide for a package addressed by string name — a removed icon fails silently at runtime and nothing in the test suite covers it. All 118 icon names used in src/ were resolved through the IconHelper and icons.ts alias maps, the alias targets added, and all 148 checked against the installed package. All resolve.

The eslint bump flagged a dead eslint-disable no-console directive in vite.app.config.ts. no-console is not configured anywhere in eslint.config.ts, so it was suppressing nothing. Removing it is the only source change in this PR.

Not addressed here

PHPUnit reports 4 deprecations for doc-comment metadata in the dictionary import tests. Verified against the previous PHPUnit by reinstalling the old lock — they predate this update and are not fallout from it. They become errors in PHPUnit 12, which is separate work.