fix(deps): patch dependency advisories and preserve OpenAPI compatibility

[voltcrash]

Patch the locked Seroval advisories and remaining production dependency paths. Production audit goes from 21 flags to zero; full audit goes from 50 to one development-only braces advisory with no published patch. Document its Madge/stylelint paths and limited exposure, keeping the advisory visible.

Preserve major-specific overrides where possible. Adapt the existing OpenAPI patch to ts-deepmerge 8's named export; cover nested constraints, defaults, descriptions and intersections. Twenty focused commits separate each dependency family, compatibility tests, adapter changes and triage.

Validation:

• Frozen dependency installation; root lint/type checking.
• OpenAPI compatibility tests: 2 pass.
• Frontend production build; backend docs and Worker dry-run build.
• Full dependency unit suites and TUI suite pass with bounded concurrency; the TUI account suite also passes in isolation.
• All ten audit branches combine without conflicts. Combined validation: 3,382 passing tests (including 105 D1 and 211 TUI), lint/type checking, source formatting and both production builds. No deployment.

The force-full-ci label runs every component on this PR while #95's shared-input routing is awaiting merge. Independent branch against main; no production deployment.

See Seroval advisory, deep-merge advisory, and remaining braces advisory. Full triage: docs/DEPENDENCY_AUDIT.md.