fix(deps): reduce residual dependency vulnerabilities 44->16

Follow-up to the initial security pass. Clears the safely-fixable
residuals so bun audit drops from 44 to 16 (0 critical / 10 high /
3 moderate / 3 low). All changes stay within declared version ranges.

Dead-dep removal (unused, referenced by no script):
- gitmoji -> cascade-drops request, tough-cookie@2.5.0, tar@2.2.2,
  node-gyp@3.8.0
- semantic-release-discord + -notifier -> drops discord.js/@discordjs/rest
  (which pinned undici@6 and blocked patching it)

Parent bumps:
- @browserbasehq/stagehand ^3.2.1/^3.0.5 -> ^3.7.0 (drops langchain +
  langsmith entirely)
- @nestjs/swagger ^11.2.0 -> ^11.4.5 (pulls patched js-yaml 4.3.0)

Overrides (backcompat-safe, verified):
- @opentelemetry/core ^2.8.0, @sigstore/core 3.2.1, markdown-it ^14.3.0,
  @babel/core ^7.29.7
- @tiptap/* pinned 3.22.1 (lockstep — the lockfile refresh floated the
  transitive @tiptap/* to 3.27.4, incompatible with @tiptap/react 3.22.1)

Lockfile refresh floats the remaining stale transitives to patched
in-range versions: undici 6.27.0/7.28.0, js-yaml 3.15.0/4.3.0,
brace-expansion, minimatch (non-bundled copies), @sigstore/verify 3.1.1.

Verified: full `turbo build` (20/20) + typecheck (0 production errors)
across all apps; apps/api Dockerfile.multistage builds clean and boots
past module-load (better-auth 1.6 loads; stops only at the expected
SECRET_KEY env guard).

Remaining 16 are all dev/build-time or no-upstream-fix: tar
(electron-builder/giget/npm-bundled), minimatch (npm-bundled), esbuild
(dev-server only), uuid (exceljs, no v8 fix), sigstore (release CI),
cookie (disjoint majors), @ai-sdk/provider-utils (low, via stagehand).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Marfuen

apps/api/package.json

@@ -61,15 +61,15 @@
         "@aws-sdk/lib-storage": "3.1013.0",
         "@aws-sdk/s3-request-presigner": "3.1013.0",
         "@browserbasehq/sdk": "2.6.0",
-        "@browserbasehq/stagehand": "^3.2.1",
+        "@browserbasehq/stagehand": "^3.7.0",
         "@inference/tracing": "^0.0.21",
         "@maced/api-client": "^0.9.2",
         "@mendable/firecrawl-js": "^4.9.3",
         "@nestjs/common": "^11.0.1",
         "@nestjs/config": "^4.0.2",
         "@nestjs/core": "^11.0.1",
         "@nestjs/platform-express": "^11.1.5",
-        "@nestjs/swagger": "^11.2.0",
+        "@nestjs/swagger": "^11.4.5",
         "@nestjs/throttler": "^6.5.0",
         "@prisma/adapter-pg": "7.6.0",
         "@prisma/client": "7.6.0",

apps/app/package.json

@@ -18,7 +18,7 @@
         "@aws-sdk/s3-request-presigner": "3.1013.0",
         "@azure/core-rest-pipeline": "^1.21.0",
         "@browserbasehq/sdk": "2.6.0",
-        "@browserbasehq/stagehand": "^3.0.5",
+        "@browserbasehq/stagehand": "^3.7.0",
         "@date-fns/tz": "^1.2.0",
         "@dnd-kit/core": "^6.3.1",
         "@dnd-kit/modifiers": "^9.0.0",