docs(cli): reconcile development dependency audit findings

[blafourcade]

🎯 What & why

Refresh #469's stale dependency audit on a valid next graph. Distinguish 18 development-only advisories (12 high, five moderate, one low) from one newer moderate production fast-uri advisory.

🛠️ How it works

Audit report records the fresh installation, dependency paths, exploit conditions and smallest compatible remediation candidates. Findings enumerate all 19 advisory IDs with versions, scopes and path witnesses.

An isolated six-package experiment removed all 12 high findings and reduced development-only advisories from 18 to three. Its full CLI suite, build, mutation canary, focused auth mutations and actual tsup/PostCSS configuration probe passed. The separately published task #1008 owns delivery and release checks for those patches.

🧪 How to verify

• Fresh cd cli && pnpm install --frozen-lockfile passes. Compare pnpm audit --json and pnpm audit --prod --json by advisory ID; both correctly exit 1 while findings remain.
• JSON validation, Markdown links, document duplication and git diff --check pass for this report.
• The separate compatibility experiment passed 7,002 tests (one skipped), typecheck, build at 750.7/751 KB, four canary mutants and 39 auth mutants. It is evidence for fix(cli): patch six development dependencies without a test-framework migration #1008, not a dependency change in this PR.

⚠️ Heads-up

No dependency, lockfile, runtime, test configuration or threshold changes. qs and esbuild need separate parent-compatibility work. The newer production fast-uri advisory is distinguished from #463's completed six original high findings.

🔗 Linked issue

Closes #469

Refs #1008

✅ I certify

• I DO CERTIFY I READ EACH LINE OF THE PULL REQUEST BECAUSE I AM A SOFTWARE ENGINEER, NOT A AI PUPPY.