[RooAC]

Summary

npm run check (and therefore CI on main) fails at the npm run audit step because of published advisories in locked transitive dependencies:

• body-parser 2.3.0 (high) and qs 6.16.0 (moderate), via @modelcontextprotocol/sdk → express
• fast-uri 3.1.8 (moderate), via @modelcontextprotocol/sdk → ajv
• vitest / @vitest/mocker 4.1.11 (moderate, dev only)

This PR only refreshes package-lock.json with npm audit fix (no --force). package.json is unchanged; every bump stays inside the existing semver ranges:

Package	Before	After
body-parser	2.3.0	2.4.0
qs	6.16.0	6.17.0
fast-uri	3.1.8	3.1.9
vitest and @vitest/*	4.1.11	4.1.12
vite	8.3.4	8.3.5
rolldown and bindings	1.2.13	1.2.15
postcss	8.5.29	8.5.32

Testing

• Fresh npm ci followed by npm run check passes locally: lint, 111 tests, build, npm audit (found 0 vulnerabilities) and npm pack --dry-run.

Checklist

• Tests were added or updated where needed. (no behavior change)
• Documentation was updated where behavior changed. (no behavior change)
• npm run check passes locally.