Upgrade the eight shipped dependencies carrying advisories

Clears every shipped finding the SBOM scan reported: pyjwt 2.13.0, idna 3.19,
axios 1.20.0, postcss 8.5.26, dompurify 3.4.14, nanoid 3.3.18, follow-redirects
1.16.0, form-data 4.0.6. All in-major bumps inside ranges the manifests already
allowed, so this is a lockfile refresh rather than a migration.

The axios and dompurify floors were raised to match, since the old ones still
nominally admitted the vulnerable range.

The PyJWT allowlist entry was removed rather than kept - it stopped matching once
the upgrade landed.

Verified: full suite 2161 passed, frontend 273 passed, build clean, npm audit
--omit=dev reports 0 vulnerabilities.

frontend/package.json

@@ -19,8 +19,8 @@
     "@fullcalendar/core": "^6.1.20",
     "@fullcalendar/daygrid": "^6.1.20",
     "@fullcalendar/vue3": "^6.1.20",
-    "axios": "^1.6.0",
-    "dompurify": "^3.4.11",
+    "axios": "^1.20.0",
+    "dompurify": "^3.4.14",
     "jsbarcode": "^3.12.3",
     "jspdf": "^4.2.1",
     "leaflet": "^1.9.4",