chore: pin npm dependencies and clear audit findings

[0xth4nh]

Summary

• Pin every package.json dependency and override to an exact version (x.y.z), and add save-exact=true so future installs stay pinned.
• Upgrade vulnerable direct packages (Next.js, sigstore, tar, shell-quote, viem) and patch remaining transitive advisories via overrides (brace-expansion, postcss, js-yaml, nanoid, ip-address).
• npm audit against the public registry now reports 0 vulnerabilities.

Why these two extra lines

• .npmrc save-exact=true: does not change the current tree (package.json is already exact). It only stops a later npm install <pkg> from writing a ^ range and undoing the pin.
• next-env.d.ts import "./.next/types/root-params.d.ts": generated by Next 16.3.1 on next build (the file says not to edit it). This app does not use root params. The file is in .gitignore but still tracked from an earlier commit, so leaving the import in keeps git status clean after a local build. Same pattern as the existing routes.d.ts import.

Test plan

• npm ci
• npm audit --registry=https://registry.npmjs.org (expect found 0 vulnerabilities; the Coinbase registry does not support the audit endpoint)
• npm run format:check
• npx tsc --noEmit
• npm run lint
• npm run build
• npm test

[cb-heimdall]

✅ Heimdall Review Status

Requirement	Status	More Info
Reviews	✅ 1/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1