chore(deps): bump http-proxy-middleware and js-yaml to resolve security alerts (#657)

Resolves Dependabot security alerts via lockfile-only bumps (no
`package.json` or override changes).

### Fixed
- **http-proxy-middleware** 2.0.9 → 2.0.10 (medium)
- **js-yaml** 3.14.2 → 3.15.0 (medium) — the v3 line pulled by
`gray-matter`; the newly-published 3.15.0 patch moved it in-range via
`pnpm update`.

The v4 `js-yaml` line also moved 4.2.0 → 4.3.0 as part of the same
update.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Author: B4nan