fix(deps): resolve high-severity advisories (axios, undici, fast-uri)

[muralx]

Problem

The Security Audit workflow (npm audit --audit-level=high --omit=dev) is failing on main — 3 high-severity advisories in the runtime dependency tree:

Package	Advisory class	Reached via
axios (1.0.0–1.17.0)	DoS + prototype pollution	@authplane/fastmcp → fastmcp
undici (7.0.0–7.27.2)	TLS-bypass, header injection, DoS	@authplane/fastmcp → fastmcp
fast-uri (3.0.0–3.1.3)	host confusion	@authplane/mcp → @modelcontextprotocol/sdk

All three are transitive through third-party packages — our workspaces declare none of them directly.

Fix

This is an npm-workspaces monorepo with a single root package-lock.json, so npm audit fix at the root resolves transitive versions across all workspaces within the upstream semver ranges — no package.json edits and no overrides required:

axios     1.16.0 -> 1.18.1
undici    7.25.0 -> 7.29.0
fast-uri  3.1.2  -> 3.1.4

Only package-lock.json changes.

Verification

• npm audit --audit-level=high --omit=dev → PASS (0 high, 0 critical; 5 moderate remain, below the gate threshold)
• npm run build → clean
• @authplane/fastmcp tests 38/38, @authplane/mcp tests 42/42

Remaining moderate (not addressed here, below the gate)

hono (JSX cross-request / cx() XSS), qs/express DoS, @hono/node-server serve-static path traversal. These don't fail CI; can be swept separately or left to dependabot.