fix: update critical security vulnerabilities in dependencies

[nkpar]

Summary

This PR addresses 4 critical and high-severity security vulnerabilities in dependencies that could lead to private key compromise and wallet drainage.

Security Fixes

Critical Vulnerabilities Fixed

1. elliptic (CRITICAL - CVSS 9.8)

   • Updated: ^6.6.1 (was <=6.6.0)
   • Issue: Private key extraction vulnerability when signing malformed input
   • Advisory: GHSA-vjh7-7g9h-fjfh

2. form-data (CRITICAL)

   • Updated: ^4.0.4 (was <4.0.4)
   • Issue: Unsafe random function for boundary generation
   • Advisory: GHSA-fjxv-7rqg-78g4

High Severity Vulnerabilities Fixed

3. axios (HIGH)

   • Updated: ^1.13.1 (was 0.24.0)
   • Issues:
     • SSRF via absolute URL (GHSA-jr5f-v2jv-69x6)
     • DoS through lack of data size check (GHSA-4hjh-wcwx-xvwj)
     • CSRF vulnerability (GHSA-wf5p-g6vw-rhxx)

4. ws (HIGH)

   • Updated: ^8.18.0 (was <7.5.10)
   • Issue: DoS when handling requests with many HTTP headers
   • Advisory: GHSA-3h5v-q93c-6h6q
   • Note: Upgraded to 8.x for better ESM support

Changes

• Updated resolutions in package.json to force secure versions
• Regenerated pnpm-lock.yaml with patched dependencies

Verification

✅ All checks passed:

• Build: All 5 packages compile successfully
• Tests: 73 unit tests passing across 4 packages
• TypeScript: No compilation errors
• Security: No critical or high vulnerabilities remaining

# Verification commands
pnpm install
pnpm run build:packages
pnpm run compile
pnpm run test
pnpm audit

Impact

Before: Critical vulnerabilities could lead to:

• Private key extraction and theft
• Wallet drainage
• SSRF, DoS, and CSRF attacks

After: All critical blockchain-specific vulnerabilities patched. Project is safe for production use with proper precautions.

Remaining Issues

6 moderate and 3 low severity issues remain (non-critical):

• langchain <0.2.19 - Path traversal
• next 15.2.4 - Image optimization issues
• vite, jsondiffpatch - Dev dependencies

These can be addressed in a follow-up PR.