fix: resolve Dependabot alerts (#184)

## Summary

- upgrade vulnerable direct and transitive dependencies to patched
releases
- regenerate dependency lockfiles and add targeted overrides where
required
- preserve application behavior while removing the reported Dependabot
exposure

## Why

The repository pinned dependency versions or lockfile resolutions
affected by open GitHub Dependabot advisories. This change moves those
dependencies to the first patched or newer compatible releases.

## Impact

Dependency audits report no known vulnerabilities after the update.
Runtime behavior is unchanged except for compatibility migrations
required by patched major releases.

## Validation

- clean dependency installation
- dependency audit with zero known vulnerabilities, where applicable
- repository-specific typechecks, tests, and production builds

## Cross-repository rollout

These PRs are independent; numbering is for tracking rather than a
required deployment sequence.

1. kasperrt/alias#5
2. kasperrt/degen#15
3. kasperrt/etys#2
4. kasperrt/henie.cool#6
5. kasperrt/idle#123
6. kasperrt/kasperrt#27
7. kasperrt/paired#4
8. kasperrt/racers-game-backend#2
9. kasperrt/racers-game-frontend#3
10. kasperrt/runtime-lab#21
11. kasperrt/shottimer#14
12. kasperrt/unhinged#12
13. #184

Author: kasperrt