security: remediate dependency and code scanning alerts

Upgrade vulnerable transitive dependencies and harden filesystem, URL, HTML, cryptographic, and input-processing boundaries identified by security scans.

package.json

@@ -82,10 +82,15 @@
   },
   "pnpm": {
     "overrides": {
+      "@xhmikosr/decompress": "^11.1.3",
       "@esbuild-kit/core-utils>esbuild": "^0.25.12",
+      "esbuild": "^0.28.1",
       "fastify": "^5.8.5",
       "fast-uri": "^3.1.1",
       "fast-xml-builder": "^1.1.7",
+      "form-data": "^4.0.6",
+      "piscina": "^4.9.3",
+      "qs": "^6.15.2",
       "ws": "^8.21.0"
     },
     "packageExtensions": {