deps: resolve open Dependabot security advisories

[ApiliumDevTeam]

Summary

Resolves the open Dependabot security advisories on the repository (171 alerts across 33 packages) by bumping direct dependencies and adding bounded pnpm.overrides for transitive packages. Also includes a small .gitignore change to keep per-developer Claude Code / superpowers files out of the public repo.

Result: pnpm audit drops from 140 → 3 vulnerabilities. The 3 remaining have no upstream fix (see below).

What changed

Dependency security fixes

• Direct deps bumped: @whiskeysockets/baileys, hono, markdown-it, tar, undici, ws, vitest, @vitest/coverage-v8.
• pnpm.overrides added/updated to force patched versions for transitive advisories. Ranges are bounded to the safe major to avoid breaking jumps that Dependabot would otherwise suggest:
  • kept on current major: undici (<8), vite (<8), basic-ftp (<6), fast-uri (<4), @hono/node-server (<2).
  • covers: axios, protobufjs, @protobufjs/utf8, dompurify, lodash, @grpc/grpc-js, @opentelemetry/{core,sdk-node,exporter-prometheus}, defu, fast-xml-builder, fast-xml-parser, follow-redirects, ip-address, simple-git, form-data, qs, brace-expansion, postcss, plus scoped overrides for uuid, vitest@3, esbuild@0.27, @vitest/browser@4.
• Extension manifests bumped: zalo (undici), matrix (markdown-it), diagnostics-otel (@opentelemetry/*), ui (vite, vitest, dompurify).

Repo hygiene

• .gitignore: ignore the whole .claude/ directory and superpowers/ / skill docs; stop tracking the committed src/gateway/server-methods/CLAUDE.md so agent instructions stay local.

Not fixable (no upstream patch)

@mariozechner/pi-coding-agent — 3 advisories (1 high, 2 low). The latest published version (0.73.1) is still within the vulnerable range and there is no patched release, so these cannot be resolved by a version bump. They account for the remaining 3 pnpm audit findings (6 Dependabot alerts across the root + lockfile manifests).

Verification

• pnpm install — clean resolution (only pre-existing peer warnings).
• pnpm tsgo — 0 type errors.
• pnpm lint — 0 errors.
• oxfmt — changed manifests formatted.
• pnpm audit — 140 → 3 (only the unfixable pi-coding-agent advisories remain).

Note: protobufjs is forced from the 6.x/7.x lines to 8.x (the only line with a fix for one advisory). Types check clean; worth a smoke test of any gRPC/OpenTelemetry paths before release.