chore: update dependencies and fix security vulnerabilities

- npm update for all semver-compatible packages (vite 8.1.5,
  concurrently 9.2.4, axios 1.18.1, better-sqlite3 12.11.1, ...)
- nodemailer 8 -> 9 (fixes GHSA-p6gq-j5cr-w38f and three further
  advisories: CRLF header injection, jsonTransport/raw file-access
  bypasses, OAuth2 TLS validation)
- override exceljs' nested uuid to ^11.1.1 (GHSA-w5hq-g745-h8pq)
  instead of the breaking exceljs downgrade npm audit suggests
- allow better-sqlite3 install script (npm allowScripts policy)

npm audit: 0 vulnerabilities

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

package.json

@@ -27,7 +27,7 @@
     "jsonwebtoken": "^9.0.0",
     "lucide-react": "^1.16.0",
     "multer": "^2.1.0",
-    "nodemailer": "^8.0.1",
+    "nodemailer": "^9.0.3",
     "otpauth": "^9.5.0",
     "pdfkit": "^0.18.0",
     "pg": "^8.18.0",
@@ -48,5 +48,13 @@
     "postcss": "^8.4.0",
     "tailwindcss": "^4.3.0",
     "vite": "^8.0.0"
+  },
+  "overrides": {
+    "exceljs": {
+      "uuid": "^11.1.1"
+    }
+  },
+  "allowScripts": {
+    "better-sqlite3@12.11.1": true
   }
 }