Fix npm audit vulnerabilities

Bump lodash 4.17.21 -> 4.18.1, axios 1.13.6 -> 1.16.0, and other
transitive deps via npm audit fix (brace-expansion, diff,
follow-redirects, js-yaml, minimatch, picomatch, yaml, ajv).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: ziimk