chore(deps): clear all 13 security advisories, unblock the server lint gate

[Pschmetzer]

npm audit reported 13 advisories (10 high) across the two workspaces. Both are now at zero.

Workspace	Before	After
server	5	0
client	8	0

Both clear on a lockfile refresh alone (npm audit fix) — no manifest changes, no dependency versions declared differently. This was the cheapest repo in the org to fix.

Also: the server lint gate was red on master

server/middleware/authMiddleware.js:12 bound catch (error) without using it, which fails npm run lint (eslint . --max-warnings 0) and therefore blocks the CI lint gate on every PR here. Replaced with an optional catch binding:

} catch {
  // The reason a token failed to verify is deliberately not surfaced to the
  // caller, and nothing here uses it, so the binding is omitted entirely.
  res.status(401).json({ message: 'Not authorized, token failed' });
}

This repo is public and is used to evaluate applicants, so a red lint gate and 10 open high advisories are considerably more visible here than in the private repos.

Not addressed

client/ has 40 pre-existing lint errors, mostly unused imports. I confirmed these are untouched by this PR by running the suite on a clean master checkout — 40 there, 40 here, identical.

They want their own cleanup PR. Folding a 40-error lint sweep into a dependency change would bury the security fix. Happy to do it separately.

Verification

Check	Result
npm ci (both workspaces)	clean
server lint	0 errors (was 1)
client vite build	✓ built
npm audit server	5 → 0
npm audit client	8 → 0

🤖 Generated with Claude Code

[github-actions]

@Pschmetzer

The following CI jobs failed:

• test-client: client lint/build failed

Logs: https://github.com/modelsuite-ai/modelsuite-qualification/actions/runs/31247754401

[Pschmetzer]

Pushed a follow-up commit: test-client was failing, and the reason turned out to matter more than the failure itself.

I had written above that client/ has "40 pre-existing lint errors, mostly unused imports" and suggested a separate cleanup. That was the wrong read — they are false positives, and cleaning them up the obvious way would have broken the app.

client/eslint.config.js loads eslint-plugin-react-hooks and eslint-plugin-react-refresh but never eslint-plugin-react, so react/jsx-uses-vars is off. Without that rule no-unused-vars cannot tell that <Sidebar /> is a use of the Sidebar import:

src/pages/admin/AdminDashboard.jsx:2    import Sidebar from '../../components/admin/Sidebar';
src/pages/admin/AdminDashboard.jsx:67       <Sidebar />

All 40 are that shape — Sidebar, TasksTable, CreateTaskModal, AvailableTasksList, Link, Logo. Deleting them to satisfy the linter would have removed components that every page renders.

eslint-plugin-react@^7.32.2 was already a declared devDependency, just not wired into the flat config. I enabled only react/jsx-uses-vars — pulling in react/recommended would introduce a large batch of unrelated findings that do not belong in this PR.

That takes client lint from 40 errors to 1, and the last one is genuine: AuthContext.jsx exports both AuthProvider and useAuth, which react-refresh/only-export-components flags. Suppressed with a comment explaining the trade-off — it costs a full reload instead of a granular Fast Refresh update while editing that one file, and splitting the hook into its own module would touch all seven consumers for no runtime benefit.

Check	Before	After
client lint	40 errors	0
server lint	0	0
client vite build	✓	✓
Sidebar still imported and rendered	—	✓ verified

Both lint gates should now be green.

[github-actions]

🎉 All CI Checks Passed!

@Pschmetzer

Tests Run:

• ✅ Client: Lint + Build
• ✅ Server: Lint + Syntax Check

Lines Changed: +3044 / -757

View detailed logs

---

Next Steps for Reviewer:

• Review code quality and implementation
• Verify testing steps in PR description
• Check for best practices and security issues
• Test functionality locally if needed

This PR is ready for human review.