fix(deps): resolve 31 Dependabot alerts in frontend dependencies

[wstlima]

Fixes #7

Summary

Dependabot flagged 31 open vulnerabilities across both frontend package-lock.json files, concentrated in:

• axios <1.16.0 — 20 advisories, several High: SSRF via no_proxy bypass, prototype-pollution gadgets enabling credential theft/auth bypass/response tampering, Proxy-Authorization credential leakage across redirects, ReDoS via cookie name injection
• react-router-dom <7.15.1 — includes an advisory for vendored turbo-stream v2 allowing arbitrary constructor invocation via TYPE_ERROR deserialization, leading to unauthenticated RCE (High)
• form-data 4.0.0–4.0.5 (both frontends, transitive via axios) — CRLF injection via unescaped multipart field names/filenames (High)
• vite <8.0.16 — server.fs.deny bypass on Windows alternate paths (High)
• @babel/core, brace-expansion, js-yaml, postcss — lower-severity fixes pulled in transitively

All fixes are patch/minor bumps within each package's existing ^ semver range — no major version changes.

How

cd frontend && npm ci
npm install --package-lock-only axios@1.16.0 react-router-dom@7.15.1 vite@8.0.16
npm audit fix

cd ../gensui/frontend && npm ci
npm audit fix

Test plan

• npm audit reports 0 vulnerabilities in both frontend/ and gensui/frontend/
• npm run build succeeds cleanly in both
• Does not touch frontend/dist/ (committed build artifacts) — dependency-only change