chore(deps): clear reachable advisories with in-range security releases (#9656)

* chore(deps): clear reachable advisories with in-range security releases

- follow-redirects 1.16.2: cross-realm sensitiveHeaders arrays were dropped on redirect
  (GHSA-mrwp-f3q8-3g9p); reached through axios in the Daytona SDK and Twilio clients.
- @hono/node-server 2.1.5: serveStatic double-decodes paths (GHSA-rmxm-3fg6-px4f); every 1.x
  is affected and the MCP SDK already accepts ^2.0.5. Sim's MCP server uses the Web-standard
  transport, so nothing serves through it today.
- body-parser 2.4.0 (GHSA-27r3-jxmh-p828) and systeminformation 5.33.16 (Trigger.dev host
  metrics; GHSA-3f7j/4vjg/7648).
- gray-matter's nested js-yaml 3.15.2 (GHSA-2883-xcg3-v3hh) and the vitest dev server's vite
  8.3.5 (launch-editor / fs.allow advisories), refreshed in the lock only.

bun audit: 45 -> 33. Remaining rows have no compatible fix or are tracked separately: msal-node
(@azure/identity still requires ^6), better-auth (1.7 upgrade PR), zod (patched), pi's pinned
undici 8.10.2, node-gyp's undici 6 (build-time only), and the previously triaged unreachable set.

* fix(db): resolve @sim/db self-imports under scripts/ in vitest

Vite 8.3 applies tsconfig paths only to files the tsconfig includes. packages/db excludes
scripts/, so script modules and their tests lost the @sim/db/* mapping and fell through to
package exports, which do not list them.

Author: waleedlatif1