chore(deps): patch runtime security vulns and fix flaky username test

[diangogav]

Summary

• Patch runtime security vulnerabilities: bun audit drops from 50 to 21
  findings, eliminating every high/critical runtime CVE (axios, form-data,
  follow-redirects, elysia, file-type).
• Fix a pre-existing flaky test in UserUsernameUpdater caused by
  UserMother generating domain-invalid usernames.

Security changes

The worst CVEs (axios prototype pollution, SSRF, credential leaks) reached the
tree transitively through @sendgrid/mail. A plain bun update left the
vulnerable nested copies in place and promoted transitives to direct deps, so
this uses a package.json overrides block to force patched versions across
the whole tree without polluting direct dependencies. SendGrid pins axios
^1.12.0, so 1.18.0 stays within its contract — no breakage.

Package	Before	After	How
elysia	1.4.23	1.4.29	direct bump
axios	1.13.5	1.18.0	override
form-data	4.0.5	4.0.6	override
follow-redirects	1.15.11	1.16.0	override

The remaining 21 findings are dev-only tooling (eslint / commitlint /
lint-staged) plus low-impact transitives where forcing overrides would risk
breaking typeorm/svix for near-zero real gain.

Test fix

UserMother built users via User.from() (no validation) with
faker.internet.username(), which often exceeds the domain's 14-char username
limit. The "keep own username" test fed that value into updateUsername() —
which does validate length and threw — so the test failed ~50% of runs.
Switched to faker.string.sample({ min: 1, max: 14 }), matching the pattern
already used by UserUsernameUpdaterRequestMother.

Changes

File	Change
package.json	bump elysia + new overrides block
bun.lock	regenerated, deduped vulnerable nested copies
tests/unit/modules/users/mothers/UserMother.ts	domain-valid username generation

Test plan

• bun audit — 50 → 21 findings, no runtime high/critical left
• bun test — 244 pass / 0 fail
• Flaky test stress: 20 consecutive runs, 0 failures