fix(deps): remediate Dependabot security advisories (#100)

Clears the open Dependabot advisories across all four manifests.

Python:
- asyncssh 2.22.0 -> 2.23.0 (path traversal in AuthorizedKeysFile %u):
  bumped the pythinker-host pin and re-locked the root workspace and the
  standalone pythinker-host lockfile.
- starlette 1.0.0 -> 1.2.1 (Host-header path poisoning), via root re-lock.

JavaScript:
- Regenerated web/, vis/, and install-counter-worker lockfiles to pull the
  already-allowed fixed versions, then ran npm audit fix.
- Bumped the worker's vitest to ^3.2.6 (critical: Vitest UI arbitrary file
  read/exec).

Verification: pythinker-host pytest (40), tests/core (1137), tests/web+acp
(41); web typecheck+build+lint, vis typecheck+build, worker vitest (14) —
all green.

Residual: a few low-severity transitive elliptic/bn.js advisories in web's
browser crypto polyfill chain, left unforced because the only fix downgrades
vite-plugin-node-polyfills and majors `ai`, breaking the build for marginal
benefit.

Author: elkaix

CHANGELOG.md

@@ -17,6 +17,7 @@ GitHub Releases page; `0.8.0` is the new starting line.
 
 - **Refreshed TUI theme and Catppuccin syntax highlighting.** The interface adopts a brand periwinkle/indigo accent (`#B3B9F4` dark / `#0B114E` light) with a reharmonized selection tint, and code blocks now highlight with Catppuccin Mocha (dark) / Latte (light), adaptive to the active theme — implemented as foreground-only Pygments styles with no new dependency. Markdown inline code and links render terminal-native cyan, blockquotes green, and ordered-list markers bright blue (so they adapt per terminal), and user messages sit on a neutral grey block instead of the prior blue tint.
 - **Homebrew updater no longer no-ops or false-reports success.** `pythinker update` on a Homebrew install now runs `brew update` to refresh the tap before `brew upgrade`, so a stale local tap clone can't pin the old formula and silently no-op ("0.37.0 already installed"). After upgrading it re-checks the installed version via `brew list --versions` and reports a clear failure instead of "Updated successfully!" when the version did not actually advance.
+- **Security: dependency vulnerability remediation.** Cleared the open Dependabot advisories across all manifests. Python: `asyncssh` 2.22.0 → 2.23.0 (path-traversal in `AuthorizedKeysFile %u`) in the `pythinker-host` pin and both lockfiles, and `starlette` 1.0.0 → 1.2.1 (Host-header path poisoning). JS: regenerated the `web`, `vis`, and `install-counter-worker` lockfiles and bumped the worker's `vitest` to `^3.2.6` (critical Vitest UI arbitrary file read/exec), clearing all critical/high/moderate advisories. The only residual is a handful of low-severity transitive `elliptic`/`bn.js` advisories in `web`'s browser crypto polyfill chain, left unforced because the fix downgrades `vite-plugin-node-polyfills` and majors `ai`, breaking the build for marginal benefit.
 
 ## 0.38.0 (2026-06-08)