chore: security dependency updates

[geocine]

Security dependency updates (single commit):

• Adds npm overrides to bump vulnerable transitive dependencies.
• Removes yarn.lock so alerts track the npm lockfile only.

Verified locally:

• npm ci
• npm test
• npm run build
• npm run bundle

Audit:

• npm audit --omit=dev: 0 vulnerabilities

[coveralls]

coverage: 98.232%. remained the same — chore/security-updates-2026-04-06 into master