Bump dompurify to 3.4.12 for GHSA-c2j3-45gr-mqc4

Dependabot alert 137 (low). Fixes a CUSTOM_ELEMENT_HANDLING hook-policy
bypass upstream; Pulse does not enable CUSTOM_ELEMENT_HANDLING so the
bump is hygiene, not an active exposure. Verified vite build, bundle
budget, and the AI chat vitest suite that exercises the sanitizer.

Contract-Neutral: Dependabot alert 137 GHSA-c2j3-45gr-mqc4: patch-level dompurify 3.4.11->3.4.12 security bump in frontend-modern; no dev-runtime orchestration, manifest-floor, or build-chunking behavior changed, contract already governs security lockfile bumps generically; dev-runtime proof artifacts are inapplicable to a frontend dependency version pin

frontend-modern/package-lock.json

@@ -10,7 +10,7 @@
       "license": "MIT",
       "dependencies": {
         "@solidjs/router": "^0.10.10",
-        "dompurify": "^3.4.11",
+        "dompurify": "^3.4.12",
         "highlight.js": "^11.11.1",
         "lucide-solid": "^0.545.0",
         "marked": "^17.0.1",
@@ -3361,9 +3361,9 @@
       "license": "MIT"
     },
     "node_modules/dompurify": {
-      "version": "3.4.11",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.11.tgz",
-      "integrity": "sha512-zhlUV12GsaRzMsf9q5M254YhA4+VuF0fG+QFqu6aYpoGlKtz+w8//jBcGVYBgQkR5GHjUomejY84AV+/uPbWdw==",
+      "version": "3.4.12",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz",
+      "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"

frontend-modern/package.json

@@ -48,7 +48,7 @@
   },
   "dependencies": {
     "@solidjs/router": "^0.10.10",
-    "dompurify": "^3.4.11",
+    "dompurify": "^3.4.12",
     "highlight.js": "^11.11.1",
     "lucide-solid": "^0.545.0",
     "marked": "^17.0.1",