Investigate undici advisory flagged by `npm audit` (via jsdom dev dep)

[momics]

Context

npm audit reports an undici advisory (1 high — GHSA-35p6-xmwp-9g52 — plus 1 moderate) pulled in transitively via jsdom (jsdom@29.1.1 → undici@7.25.0), a dev/test-only dependency of the Tauri package.

This is pre-existing and unrelated to the iroh 1.0 work (#236): package-lock.json is unchanged on that branch (git diff main is empty), so the advisory exists on main today and would fail the CI npm audit step independently.

Tasks

• Confirm the dependency path (npm ls undici) and which package(s) pull it in.
• Determine fix: npm audit fix, bumping jsdom, or overriding undici via a package.json overrides entry.
• Verify the override/bump doesn't break test:node / test:deno / test:interop.
• Confirm scope: dev/test-only, so no runtime exposure — document the risk assessment.
• Open a focused PR with the fix.

Notes

• Keep this separate from Upgrade iroh dependency from 0.98.x to 1.0 #236 so the iroh upgrade isn't blocked on a security-tooling change.