chore(deps): bump immutable 5.1.9, fast-uri 3.1.4, sharp 0.35.3 (yarn audit gate)

Five HIGH advisories were failing the "yarn audit (both trees)" CI gate.
They are newly-published advisories in existing transitive deps (not
introduced by this branch) — pre-existing on staging too:

- immutable >=5.0.0-beta.1 <5.1.8 (GHSA-v56q-mh7h-f735 List trie DoS,
  GHSA-xvcm-6775-5m9r Map/Set hash-collision DoS) via sass>immutable.
  The resolution already pinned immutable to 5.1.5 (still vulnerable) in
  both trees; bumped to 5.1.9.
- fast-uri >=3.0.0 <=3.1.3 (GHSA-v2hh-gcrm-f6hx, GHSA-4c8g-83qw-93j6
  host-confusion) via electron-store>conf>ajv>fast-uri. Root resolution
  bumped 3.1.2 -> 3.1.4.
- sharp <0.35.0 (GHSA-f88m-g3jw-g9cj, libvips CVE-2026-33327/33328/
  35590/35591) via next>sharp. Added a sharp 0.35.3 resolution in both
  trees.

New transitive @img/colour is MIT and new @img/sharp-* wasm variants are
Apache-2.0 (both allowlisted); @img/sharp-libvips-* covered by the
existing prefix exemption. audit:prod now green on both trees.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Tanya-atatakai

frontend/package.json

@@ -11,14 +11,15 @@
     "form-data": "4.0.6",
     "glob": "10.5.0",
     "handlebars": "4.7.9",
-    "immutable": "5.1.5",
+    "immutable": "5.1.9",
     "ip-address": "10.1.1",
     "js-yaml": "4.3.0",
     "lodash": "4.18.1",
     "lodash-es": "4.18.1",
     "minimatch": "9.0.9",
     "picomatch": "4.0.4",
     "postcss": "8.5.10",
+    "sharp": "0.35.3",
     "tar": "7.5.16",
     "ws": "8.21.0"
   },