chore(deps): take the multer and nodemailer fixes for four HIGH CVEs

Docker Scout turned the release PR red overnight on advisories published
after the last green run:

  multer < 2.3.0      CVE-2026-82333, CVE-2026-77078, CVE-2026-77037
  nodemailer < 9.1.0  GHSA-2x7j-588g-ccc2

Both are patch-level resource-exhaustion fixes with no API change — multer
2.3.0 carries the same four dependencies as 2.2.0. multer resolves through
the root override (@nestjs/platform-express asks for 2.1.1), so the range
there has to move with it, and the server's own override list beside it.

server/package.json

@@ -54,7 +54,7 @@
     "json5": "^2.2.3",
     "jsonwebtoken": "^9.0.2",
     "nestjs-zod": "^5.5.0",
-    "nodemailer": "^9.0.1",
+    "nodemailer": "^9.1.1",
     "otplib": "^12.0.1",
     "pdf-parse": "^2.4.5",
     "qrcode": "^1.5.4",
@@ -76,7 +76,7 @@
     "@hono/node-server": "^1.19.13",
     "picomatch": "^4.0.4",
     "ip-address": "^10.1.1",
-    "multer": "^2.2.0",
+    "multer": "^2.3.0",
     "ws": "^8.21.0",
     "qs": "^6.15.2",
     "file-type": "^21.3.4"