[jmgasper]

Patch vulnerable runtime and development dependencies, including the separate migration tool, and use Node 26.12.1 in the container build. Keep Express 4 on patched body-parser 1.20.9 and Nest on 2.4.0; both fix GHSA-27r3-jxmh-p828.

Preserve older glob consumers with an adapter backed by minimatch 11. Patch Newman/Postman Collection for the secure CSV and Faker APIs. Upgrade the migrator's stream-json/stream-chain dependencies, update their module paths, and support progress logging without a TTY. The migrator's npm configuration installs the local matcher adapter as a package so a clean install resolves it correctly.

Validation:

• Root and migrator audits: zero critical/high/moderate findings (two low root, six low migrator); root production audit: zero findings.
• All 51 collected target-severity Dependabot alerts checked against their actual manifests/lockfiles and patched or removed. Runtime versions address all 29 collected target-severity ECR findings.
• Docker build, lint, compilation, and five compatibility tests pass, including every Postman dynamic generator and a CSV-driven local Newman request.
• 25 focused API tests pass. Two migration regressions pass after clean npm installation and under Node 26: streaming records, malformed input, prototype safety, filtering, batching, and failure logs.
• Non-root runtime, compressed-body rejection, and nested form parsing checks pass. The full database integration suite requires disposable Resource, Member, and Challenge databases and was not run.

Deployed ECR findings require merge, rebuild, and deployment. This PR does not deploy or run data migrations.