Bump platform dependencies and dev tools - #164

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@demo/a2a-oid4vp/.yarnrc.yml`:
- Around line 1-2: The Yarn config currently disables supply-chain guardrails by
setting approvedGitRepositories to "**" and npmMinimalAgeGate to 0; update the
config to use an explicit allowlist for approvedGitRepositories (replace the
"**" wildcard with a list of trusted repo URLs or org patterns) and set
npmMinimalAgeGate to a non-zero value (e.g., a few days) to re-enable
package-age gating; ensure both keys (approvedGitRepositories and
npmMinimalAgeGate) are present and documented so reviewers can verify the
allowed repos and chosen age threshold.

In `@heka-auth-service/.yarnrc.yml`:
- Around line 1-2: The approvedGitRepositories setting currently uses a wildcard
("**") which disables git-source allowlisting; update the .yarnrc.yml by
replacing approvedGitRepositories: - "**" with a limited list of explicit
trusted org/repo patterns (for example entries matching your orgs or specific
repos) or remove the approvedGitRepositories key entirely if you don't need
allowlisting; ensure you modify the approvedGitRepositories entry so it only
contains safe, explicit patterns rather than the global wildcard.
- Line 8: The npmMinimalAgeGate is set to 0 which disables the quarantine window
for newly published packages; update the npmMinimalAgeGate setting in the
configuration to a positive integer (e.g., 3 or 7 days) to enforce an age gate,
validate that the change is applied by running your package manager lint/check,
and add a brief note in the repository’s contributing or security docs
describing the allowed exception process for any future overrides of
npmMinimalAgeGate.

In `@heka-auth-service/package.json`:
- Around line 90-91: The pinned dependency typescript-eslint at "8.60.1" is
tripping the StepSecurity cooldown; update the version in package.json to an
earlier patch that's already passed the cooldown (for example pick an 8.5x or an
early 8.60.x release published before 2026-06-01) so CI passes immediately, then
run npm/yarn install to update lockfile; keep the package name
"typescript-eslint" unchanged and only adjust the version string.
- Around line 26-28: The engines.node range in package.json currently allows
Node 21.x which ESLint 10 rejects; update the "engines": { "node": ... } field
(and the same field duplicated in other package.json files) to the tightened,
ESLint-supported range (e.g. ^20.19.0 || ^22.13.0 || >=24) so the manifest
cannot advertise an unrunnable Node version.

In `@heka-identity-service-web-ui/.yarnrc.yml`:
- Line 8: The npmMinimalAgeGate value is set to 0 which disables the publish-age
guard; update the npmMinimalAgeGate setting in .yarnrc.yml to a positive integer
(e.g., 30) to enforce a minimum package publish age for baseline supply-chain
protection and document any intentional override in repo policy; change the
value referenced by the npmMinimalAgeGate key and commit with a brief
justification.
- Around line 1-2: The approvedGitRepositories entry currently uses a wildcard
("**") which allows any git source; replace that value with a minimal allowlist
of trusted hosts/orgs/repos by updating the approvedGitRepositories YAML list
(replace the "**" list item) to explicit patterns or specific repos (e.g.
"github.com:your-org/*", "gitlab.com:trusted-team/*", or
"github.com:your-org/specific-repo") appropriate for your project, ensure the
entries follow Yarn's accepted host/repo pattern syntax and keep the list as
small and specific as possible.

In `@heka-identity-service/.yarnrc.yml`:
- Around line 1-4: The .yarnrc.yml currently sets approvedGitRepositories:
["**"] with enableScripts: true which allows any git-hosted dependency to run
lifecycle scripts; tighten this by replacing the wildcard with explicit allowed
repo patterns (or remove approvedGitRepositories entirely if no git deps are
used) and/or set a safer allowlist such as specific org/repo globs, ensuring
postinstall (patch-package) in package.json still runs as expected; update the
approvedGitRepositories entry and keep enableScripts only if needed so that
arbitrary git+ / github: dependencies cannot execute install scripts.

In `@heka-identity-service/test/revocation.e2e.test.ts`:
- Around line 22-23: The variables revocationRegistryDefinitionId and
revocationIndex are declared with definite-assignment assertions which hide that
they are never actually set; update their declarations
(revocationRegistryDefinitionId, revocationIndex) so they are either initialized
with a real value or typed as optional (e.g., string | undefined / number |
undefined) and ensure they are assigned in the test setup (beforeAll/beforeEach)
from the helper that creates the revocation registry; additionally add explicit
runtime checks or expect assertions before use so tests fail with a clear
message if setup didn't assign them.

---

Outside diff comments:
In `@heka-auth-service/Dockerfile`:
- Around line 16-32: The final Dockerfile stage currently runs as root (no USER
set) which is insecure; create or use a non-root user (e.g., add a user like
"app" or use the standard node user), chown the application files/directories
copied into WORKDIR (migrations, dist, node_modules, package*.json, .yarn,
.yarnrc.yml) to that user, set USER to that non-root user before the CMD, and
ensure any startup commands (yarn migration:up && yarn start) run with that
user's permissions; reference the Dockerfile CMD and the copied paths
(migrations, dist, node_modules, package*.json, .yarn, .yarnrc.yml) and perform
chown after COPY and before switching USER.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@heka-wallet/package.json`:
- Around line 31-34: The engines.yarn constraint is out of sync with the
packageManager pin; update the "engines".yarn value to require at least the
Corepack-pinned version by changing the engines.yarn entry from "^4.9.4" to
"^4.16.0" so it matches the packageManager: "yarn@4.16.0" declaration and
prevents version drift.