Fix high-severity dependency vulnerabilities

Clears high and critical advisories with the smallest safe upgrades.

Last checked against the current Claude Code facts on 2026-11-07.

More security prompts

• Move every hard-coded secret out of the code
• Validate every request body at the boundary

New to /goal? Read Let Claude run until it is done with /goal.