chore(security): work down the pnpm audit backlog (136 advisories)

[mrlemoos]

pnpm audit --audit-level moderate has been failing on main since at least 2026-07-31, so the audit workflow is a permanently red gate. PR #39 was merged with --admin on that basis (lint + test were made green there).

Current state

136 advisories across 38 packages: 1 critical, 54 high, 63 moderate, 15 low. --prod only drops it to 133 — the vulnerable packages arrive through root tooling, not app dependencies.

Severity	Package	Patched	Reached via
critical	@xhmikosr/decompress	>=11.1.3	@swc/cli
high	electron	>=41.4.0	direct (catalog: 41.2.1)
high	sharp	>=0.35.0	direct
high	astro	>=6.3.3	direct (marketing)
high	multer	>=2.2.0	direct
high	undici	>=7.28.0	@nx/react, electron-builder, jsdom
high	ws	>=8.21.0	@clerk/expo, @expo/cli
high	brace-expansion	>=2.1.2	@expo/cli, @nx/eslint, nx
high	axios	>=1.16.0	wait-on
high	tmp, form-data, app-builder-lib, builder-util-runtime	various	electron-builder
high	adm-zip, http-proxy-middleware	various	@nx/react
high	piscina	>=4.9.3	@swc/cli
high	fast-uri, linkify-it, svgo, ip-address	various	ajv, @tiptap/pm, @nx/next, shadcn
no fix	url-regex, request	<0.0.0	to-ico

Suggested order

1. Bump the direct deps that have patches: electron, sharp, astro, multer.
2. Add pnpm.overrides for patchable transitives (@xhmikosr/decompress, undici, ws, brace-expansion, axios, tmp, form-data, …), verifying builds after each group.
3. Decide what to do about to-ico → url-regex / request, which have no patched version. Either replace to-ico in the icon generation script or add a documented ignoreGhsas entry.
4. Only once the count can actually reach zero, treat audit as a blocking gate again.

Until then the workflow reports red on every PR and carries no signal.