Dependency security update

Conservative, in-range dependency remediation. Review + QA before merge.

What changed

• npm update — semver-safe, in-range refresh of the dependency tree. This notably bumped the openclaw devDependency 2026.4.21 → 2026.5.7, which clears the bulk of the advisories (most were transitive through openclaw's tree: @anthropic-ai/sdk, basic-ftp, hono, fast-xml-*, etc.).
• Added overrides to package.json:
  • ws → ^8.21.0 (clears the vulnerable ws nested under viem — memory-exhaustion DoS GHSA-96hv-2xvq-fx4p)
  • postcss → ^8.5.10 (floor; already resolves to 8.5.16)
• Only package.json + package-lock.json are committed.

Not changed (deliberate, documented residual)

• vitest left at ^4.1.3 (already newer than any security floor — no downgrade).
• No next / @vitest/coverage-v8 present.
• uuid left at v9-line (v9→v11 is a risky major; transitive via openclaw dev tooling).

Audit: before → after

• Before: 0 critical, 11 high, 16 moderate, 1 low (28 total)
• After: 0 critical, 3 high, 4 moderate, 1 low (8 total)

Residual advisories are all dev-only, transitive through the openclaw devDependency toolchain and require breaking/major bumps: esbuild, markdown-it, tar, undici, uuid, @mariozechner/pi-coding-agent. None affect the published runtime deps (@scure/*, @solana/kit, @x402/*, viem).

Build / test status

• ✅ Build passes (npm run build / tsup — clean ESM + DTS).
• ⚠️ Tests: 492 passed, 2 failed, 3 skipped. The 2 failures are both in test/integration/security-scanner.test.ts (result.findings is undefined). Root cause: the in-range openclaw 2026.4.21 → 2026.5.7 bump changed the shape of openclaw's security-scanner result. This is a dev-only integration test against openclaw's API, not a runtime/build/compile failure, and not caused by any next/vitest bump (none applied here).
  • Reviewer action: either update security-scanner.test.ts for openclaw 2026.5.7's new scanner result shape, or pin openclaw back to 2026.4.21 (which would re-introduce some of the cleared dev-tree advisories).

⚠️ Human review + QA required before merge. Do not auto-merge.