#15: update vulnerable production dependencies (npm audit fix)

Clears 1 critical and 25 high advisories; only the lockfile changes.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

CHANGELOG.md

@@ -37,5 +37,12 @@ First versioned release. It collects the state of CraftDock on 2026-11-01.
   from a fresh history at the 2026-11-01 state.
 - `.gitattributes` forces LF line endings.
 
+### Security
+
+- Updated the lockfile (`npm audit fix`, no `package.json` change) to clear 1 critical and
+  25 high advisories reported by Trivy in production dependencies: `proxy-addr`, `axios`,
+  `body-parser`, `multer`, `engine.io`, `@grpc/grpc-js`, `follow-redirects` and
+  `brace-expansion`.
+
 [Unreleased]: https://git.lucasrguerra.dev.br/lucasrguerra/craftdock/compare/v0.1.0...HEAD
 [0.1.0]: https://git.lucasrguerra.dev.br/lucasrguerra/craftdock/releases/tag/v0.1.0