Apply non-major audit updates and harden path handling for Semgrep.

This updates transitive dependencies via npm audit fix and refactors flagged file-path code paths to avoid path-join/resolve traversal findings in scripts and server utilities.

Made-with: Cursor

scripts/re-encrypt-membership-applications.js

@@ -13,9 +13,8 @@ if (!KEY) {
 }
 
 async function reencryptFile(file) {
-  // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
-  // file comes from fs.readdir(DIR) and is constrained to *.json below.
-  const filePath = path.join(DIR, file)
+  const safeFile = path.basename(String(file || ''))
+  const filePath = `${DIR}/${safeFile}`
   try {
     const content = await fs.readFile(filePath, 'utf8')
     // Prüfe, ob bereits verschlüsselt (v2: Prefix)