chore(deps): take the multer and nodemailer fixes for four HIGH CVEs

Docker Scout turned the release PR red overnight on advisories published
after the last green run:

  multer < 2.3.0      CVE-2026-82333, CVE-2026-77078, CVE-2026-77037
  nodemailer < 9.1.0  GHSA-2x7j-588g-ccc2

Both are patch-level resource-exhaustion fixes with no API change — multer
2.3.0 carries the same four dependencies as 2.2.0. multer resolves through
the root override (@nestjs/platform-express asks for 2.1.1), so the range
there has to move with it, and the server's own override list beside it.

package-lock.json

@@ -27,7 +27,6 @@
       "name": "@trek/client",
       "version": "4.2.0",
       "dependencies": {
-        "@mapbox/mapbox-gl-rtl-text": "^0.4.0",
         "@fontsource/bebas-neue": "^5.3.0",
         "@fontsource/eb-garamond": "^5.3.0",
         "@fontsource/geist-sans": "^5.2.5",
@@ -36,6 +35,7 @@
         "@fontsource/museomoderno": "^5.3.0",
         "@fontsource/playfair-display": "^5.3.0",
         "@fontsource/poppins": "^5.2.7",
+        "@mapbox/mapbox-gl-rtl-text": "^0.4.0",
         "@maplibre/maplibre-gl-leaflet": "0.1.4",
         "@simplewebauthn/browser": "^13.1.2",
         "@trek/shared": "*",
@@ -15688,9 +15688,9 @@
       }
     },
     "node_modules/multer": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/multer/-/multer-2.2.0.tgz",
-      "integrity": "sha512-6rdyFg2kLrMh9Jee7/BMPuV9lEAd7lLW2YUpF9/YxR7njyoUwwQ0ZPh3TaIY50Sw6vlyD2HW3wGOkTS4P79xrQ==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/multer/-/multer-2.3.0.tgz",
+      "integrity": "sha512-cjNbm3sttszgZeGfJR124D+jFEfkXCVAsoPBmFn9X7UxmDSFHWqE2CoEj0vrmSpuAFnqWR1Szcm9QTsiHr60Xw==",
       "license": "MIT",
       "dependencies": {
         "append-field": "^1.0.0",
@@ -15824,9 +15824,9 @@
       }
     },
     "node_modules/nodemailer": {
-      "version": "9.0.1",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.0.1.tgz",
-      "integrity": "sha512-Gwv8SQewT616ZM/URn0H54b8PWo/Wum7md3EW2aWy1lO27+WZCX+Xyak3J+NlmHUjDh5ME+uesJUDRbR3Ye8Bw==",
+      "version": "9.1.1",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.1.1.tgz",
+      "integrity": "sha512-izw9mVKFix6YSnC9eLgV6g1opl9DUlRio9ZNcq+Wu9Ujn2UwF+8Nl0B8nz22kEC+CTZCvinkxwJ0DeFbb6NwcQ==",
       "license": "MIT-0",
       "engines": {
         "node": ">=6.0.0"
@@ -21757,7 +21757,7 @@
         "json5": "^2.2.3",
         "jsonwebtoken": "^9.0.2",
         "nestjs-zod": "^5.5.0",
-        "nodemailer": "^9.0.1",
+        "nodemailer": "^9.1.1",
         "otplib": "^12.0.1",
         "pdf-parse": "^2.4.5",
         "qrcode": "^1.5.4",