chore: upgrade dependencies for security

[outbounder]

Summary

• Upgrade vulnerable webapp, REST API, MCP server, worker, and shared dependency versions.
• Add root npm overrides/pins so transitive security-sensitive packages resolve to patched versions.
• Fix REST API consolidation build compatibility and add root ESLint 9 flat config for server workspaces.
• Update docs/SPEC.md with the current dependency security baseline.

Test plan

• npm audit
• npm run typecheck
• npm run build --workspace=apps/webapp
• npm run build --workspace=apps/rest-api
• npm run build --workspace=apps/mcp-server
• npm run lint --workspace=apps/webapp
• npm run lint --workspace=apps/rest-api
• npm run lint --workspace=apps/mcp-server

Made with Cursor