fix(deps): bump dompurify to 3.4.0 to resolve four advisories (#801)

Resolves four DOMPurify advisories all patched in 3.4.0:
- GHSA-39q2-94rc-95cp (ADD_TAGS function form bypasses FORBID_TAGS)
- GHSA-v9jr-rg53-9pgp (CVE-2026-41238: prototype pollution to XSS via
  CUSTOM_ELEMENT_HANDLING fallback)
- GHSA-h7mw-gpvr-xq4m (CVE-2026-41240: FORBID_TAGS bypass via function-based
  ADD_TAGS predicate)
- GHSA-crv5-9vww-q3g8 (CVE-2026-41239: SAFE_FOR_TEMPLATES bypass in
  RETURN_DOM mode)

Bump is on the npm overrides entry (dompurify is a transitive dep), which
forces the resolved version up the tree. Lockfile picks up 3.4.1 (latest
3.4.x). Frontend build clean, dev server boot clean, no runtime errors.

frontend/package-lock.json

@@ -4654,9 +4654,9 @@
       "license": "MIT"
     },
     "node_modules/dompurify": {
-      "version": "3.3.3",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.3.3.tgz",
-      "integrity": "sha512-Oj6pzI2+RqBfFG+qOaOLbFXLQ90ARpcGG6UePL82bJLtdsa6CYJD7nmiU8MW9nQNOtCHV3lZ/Bzq1X0QYbBZCA==",
+      "version": "3.4.1",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.1.tgz",
+      "integrity": "sha512-JahakDAIg1gyOm7dlgWSDjV4n7Ip2PKR55NIT6jrMfIgLFgWo81vdr1/QGqWtFNRqXP9UV71oVePtjqS2ebnPw==",
       "license": "(MPL-2.0 OR Apache-2.0)",
       "optionalDependencies": {
         "@types/trusted-types": "^2.0.7"

frontend/package.json

@@ -57,7 +57,7 @@
     "yaml": "^2.8.3"
   },
   "overrides": {
-    "dompurify": "^3.3.3"
+    "dompurify": "^3.4.0"
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",