chore(deps): update vulnerable packages to patched versions

Updated packages:
- simple-git 3.32.3 → 3.36.0 (RCE vulnerability)
- fast-uri 3.1.0 → 3.1.2 (host confusion, path traversal)
- dompurify 3.3.1 → 3.4.5 (XSS bypasses)
- mermaid 11.13.0 → 11.15.0 (CSS injection, DoS)
- uuid 11.1.0 → 11.1.1 (buffer bounds check)
- ws 8.20.0 → 8.20.0 (uninitialized memory)
- ip-address 10.1.0 → 10.2.0 (XSS)
- @xmldom/xmldom 0.8.11 → 0.9.10 (XML injection, DoS)
- docx4js 3.3.0 → 2.0.1 (breaks xml2js dep chain)
- brace-expansion (transitive update)

Also applied lint:fix autofix (const correctness).

Amit Haridas

src/renderer.js

@@ -132,7 +132,7 @@ function plantumlEncode(text) {
 }
 
 // Module-level reference set by DOMContentLoaded after sidebar registration
-let outlinePanelContainer = null;
+const outlinePanelContainer = null;
 
 // Tab Management
 class TabManager {
@@ -1489,7 +1489,7 @@ document.addEventListener('DOMContentLoaded', async () => {
     // Initialize sidebar
     const SidebarManager = getSidebarManager();
     const sidebarManager = new SidebarManager();
-    let explorerCurrentDir = null;
+    const explorerCurrentDir = null;
 
     sidebarManager.registerPanel('explorer', {
         title: 'Explorer',
@@ -3416,7 +3416,7 @@ function showPDFValidationMessage(message, focusSelector = null) {
 // Process PDF Operation
 function processPDFOperation() {
     const operation = currentPDFOperation;
-    let operationData = { operation };
+    const operationData = { operation };
 
     try {
         switch (operation) {
@@ -4206,7 +4206,7 @@ function textToASCII(text, style) {
         lines[i] = '';
     }
 
-    for (let char of upperText) {
+    for (const char of upperText) {
         const charLines = font.chars[char] || font.chars[' '];
         if (charLines) {
             for (let i = 0; i < font.height; i++) {
@@ -4244,7 +4244,7 @@ function createASCIIBox(text, style, padding) {
     }
 
     // Content lines
-    for (let line of lines) {
+    for (const line of lines) {
         const paddedLine = line.padEnd(maxLength, ' ');
         result += chars.v + ' '.repeat(padding) + paddedLine + ' '.repeat(padding) + chars.v + '\n';
     }