chore: consolidate dependabot updates

[erikfrerejean]

Consolidates the following Dependabot PRs and rebuilds the dist bundles:

• build(deps): bump fast-uri from 3.1.4 to 3.1.5 in the npm_and_yarn group across 1 directory #419 build(deps): bump fast-uri from 3.1.4 to 3.1.5 in the npm_and_yarn group across 1 directory
• build(deps-dev): bump js-yaml from 5.2.2 to 5.2.3 #420 build(deps-dev): bump js-yaml from 5.2.2 to 5.2.3

Both cherry-picked cleanly onto 6 (the package-lock.json overlap auto-merged); no manual conflict resolution was needed.

Bundles rebuilt: no changes. npm ci + npm run build produced a byte-identical client/dist/ — expected, since fast-uri is a transitive dependency of the tooling and js-yaml is a devDependency, so neither reaches the production bundle.

QA suite: passed (npm run qa — Biome + Stylelint + typecheck + Vitest + i18n parity + vite build). 1147 tests across 77 files, exit 0.