Remove dependency audit advisories

[simongonzalezdc]

Pull Request

Empower Orchestrator checklist

• I checked whether this PR reveals a repeatable task or recurring agent failure.
• If it does, I either shipped the smallest durable improvement or documented why not.
• Any automation or durable system change included the scale/severity/reversibility/predictability blast-radius check.
• Workers/subagents stayed inside their assigned scope and verification evidence is included before completion claims.

Summary

• Add npm overrides for the vulnerable transitive packages currently pulled by Expo and Prisma.
• Refresh the lockfile narrowly so npm audit no longer reports GHSA-92pp-h63x-v22m or the PostCSS advisory.
• Avoid npm audit fix --force because it proposes a Prisma major-line downgrade.

Verification

• npm ci
• npm audit --audit-level=moderate
• npm audit --audit-level=high
• npm run typecheck --workspaces --if-present
• npm run lint --workspaces --if-present
• npm run build --workspace=packages/shared
• DATABASE_URL=postgresql://test:test@localhost:55432/innerscape_test JWT_SECRET=ci-test-secret-do-not-use-in-production npx prisma generate
• DATABASE_URL=postgresql://test:test@localhost:55432/innerscape_test JWT_SECRET=ci-test-secret-do-not-use-in-production npx prisma db push
• DATABASE_URL=postgresql://test:test@localhost:55432/innerscape_test JWT_SECRET=ci-test-secret-do-not-use-in-production npm test --workspace=apps/backend

Notes

• apps/mobile still has a test script that invokes jest without declaring jest; CI only runs mobile typecheck, so mobile jest was not used as a completion gate.

---

^{Need help on this PR? Tag @codesmith with what you need.}

• Let Codesmith autofix CI failures and bot reviews