Fix: bump JS deps to resolve Dependabot security alerts

[whusterj]

Summary

Bumps JS dependencies in the web (React) and mobile (React Native) templates to resolve open Dependabot security alerts. Most were transitive dependencies updated via npm update; overrides were added where semver constraints prevented natural resolution.

Alerts resolved

• flatted 3.3.3 → 3.4.2 — prototype pollution + unbounded recursion DoS (alerts update the actions to cancel existing actions #429, Modernize README with professional branding and improved user experience #428, Agent Types on Prompt Template #417)
• ajv 6.12.6 → 6.14.0 — ReDoS with $data option (alerts fix: Add docker create test data #412, adds vite/deps to gitignore for docker #411)
• minimatch 3.x (3.1.2 → 3.1.5) and 9.x (9.0.5 → 9.0.9) — ReDoS (alerts pr-summary work #407, Expo Builds per PR #403)
• serialize-javascript 6.0.2 → 7.0.4 via override — RCE via RegExp.flags (alerts added mobile to docker #406, Update vite.config.ts #405)
• zod (React Native) 3.21.4 → 3.25.76 — denial of service (alert Upgrade Node.js to v22 and optimize Playwright workflow #427)

Approach

• serialize-javascript pinned via overrides in both package.json files (transitive dep of webpack-related tooling)
• zod bumped as a direct dependency in the RN template
• @typescript-eslint/utils minimatch pinned via override in the RN template
• All lock files regenerated with npm install