ui: bump next to 15.5.24 and axios to 1.20.0 to clear published advisories #275

ui/package.json on main pins next 15.4.10 and axios 1.12.0. Both have published advisories whose fixes are already on the same major line, and they ship in the server image (the dashboard is built into server/ui-dist), so they are runtime for anyone deploying from this repo.

next 15.4.10 — GitHub Advisory Database lists 2 critical, 12 high, 11 moderate and 2 low advisories against this version. First patched versions range from 15.4.11 up to 15.5.24 (the two critical ones). Staying on 15.x, 15.5.24 clears all of them.

axios 1.12.0 — 11 high, 18 moderate, 1 low advisories; first patched versions range from 1.13.5 up to 1.20.0 (>=1.13.0 <1.20.0, published this month). 1.20.0 clears all of them.

Both are minor bumps within the current majors. We bumped them in a downstream fork (plus a pnpm update of the runtime transitives: nanoid, sharp, lodash, form-data, follow-redirects, browserslist, baseline-browser-mapping, postcss 8.5.x) and the dashboard builds with pnpm install --frozen-lockfile and behaves the same: agents list, controls tab, control edit form, light and dark, desktop and phone.

Two remaining findings need parent bumps rather than a pin change, so they are left for you to decide: dompurify 3.2.7 is pinned exactly by monaco-editor 0.55.1 (0.57.0 moves to 3.4.15), and postcss 8.4.31 is next's own build-time dependency.

Happy to open a PR if you would like the change upstream.