Update and unpin server dependencies

[JEK58]

Summary

• upgrade and unpin axios to ^1.18.1
• upgrade and unpin multer to ^2.2.0
• align @types/express with Express 5 at ^5.0.6
• type scalar :id route parameters explicitly for the Express 5 definitions
• refresh the server pnpm lockfile

Why

The server still had three exact-version dependency pins. Updating them removes stale constraints, brings Multer onto the current security-patched 2.x line, and aligns the Express typings with the existing Express 5 runtime. The Express typing upgrade widened generic route parameters, so scalar :id routes now declare their parameter shape explicitly.

Impact

Runtime upload and HTTP APIs remain unchanged. Dependency updates will now be accepted within their current major versions through the caret ranges.

Validation

• CI=1 pnpm typecheck (server)
• CI=1 pnpm build (server)
• CI=1 pnpm lint (server)
• local Jest suite excluding third-party integration tests: 86 passed, 2 skipped
• CI=1 pnpm build (client)
• loopback Axios 1.18.1 smoke test: GET retry and multipart POST passed

The Google Maps and FAI validator integration tests reached Axios request execution but could not complete because third-party network egress was unavailable in the validation environment.