fix(security): resolve high/critical npm audit vulnerabilities + semgrep

npm audit:
- Add overrides: serialize-javascript>=7.0.5, postcss>=8.5.10, axios>=1.8.2
  to force safe transitive dependency versions
- Upgrade vitest 3.2.4 -> 4.1.8 (CRITICAL CVE-2025-*: arbitrary file read
  when UI server is listening)
- Upgrade @vitest/ui 3.x -> 4.1.8 to match

semgrep:
- Add # nosemgrep: dockerfile.security.missing-user comment with rationale
  (Tor requires root to start; entrypoint drops to debian-tor for tor process)

Result: 0 high/critical vulnerabilities (2 low remaining, below audit threshold)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ralyodio

Dockerfile

@@ -97,6 +97,9 @@ COPY entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 EXPOSE 8080
+# nosemgrep: dockerfile.security.missing-user.missing-user
+# Tor requires root at startup (chown /var/lib/tor, run tor daemon); entrypoint
+# drops to debian-tor for the tor process. A non-root USER here would break it.
 ENTRYPOINT ["/usr/bin/tini","--"] # nosemgrep: dockerfile.security.missing-user-entrypoint
-CMD ["/entrypoint.sh"] # nosemgrep: dockerfile.security.missing-user
+CMD ["/entrypoint.sh"]