Security: patch-level dependency overrides, electron 42.11.12; add Gitea CI

- Lockfile-only/overrides bumps within the same major for vulnerable
  transitive build/test tooling (see pnpm-overrides.md)
- electron 42.0.1 -> 42.11.12 (same major) for runtime advisories
- .gitea/workflows/ci.yml: single job (build admin, tests, audit)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

package.json

@@ -52,9 +52,44 @@
       "ember-try-config>package-json": "^10.0.1",
       "ember-loading>ember-concurrency": "^4.0.0",
       "tmp": "^0.2.7",
-      "tar": "^7.5.10",
+      "tar": "^7.5.22",
       "nomnom>underscore": "^1.13.8",
-      "ember-cli>markdown-it": "^14.2.0"
+      "ember-cli>markdown-it": "^14.3.2",
+      "diff@>=5.0.0 <6.0.0": "^5.2.2",
+      "qs@>=6.0.0 <7.0.0": "^6.16.0",
+      "follow-redirects@>=1.0.0 <2.0.0": "^1.16.1",
+      "postcss@>=8.0.0 <9.0.0": "^8.5.29",
+      "ws@>=8.0.0 <9.0.0": "^8.22.0",
+      "brace-expansion@>=5.0.0 <6.0.0": "^5.0.12",
+      "brace-expansion@>=2.0.0 <3.0.0": "^2.1.7",
+      "brace-expansion@>=1.0.0 <2.0.0": "^1.1.21",
+      "form-data@>=4.0.0 <5.0.0": "^4.0.6",
+      "js-yaml@>=3.0.0 <4.0.0": "^3.15.2",
+      "js-yaml@>=4.0.0 <5.0.0": "^4.3.2",
+      "morgan@>=1.0.0 <2.0.0": "^1.12.1",
+      "@babel/core@>=7.0.0 <8.0.0": "^7.29.7",
+      "engine.io@>=6.0.0 <7.0.0": "^6.6.11",
+      "shell-quote@>=1.0.0 <2.0.0": "^1.12.0",
+      "body-parser@>=1.0.0 <2.0.0": "^1.20.8",
+      "linkify-it@>=5.0.0 <6.0.0": "^5.0.2",
+      "seroval@>=1.0.0 <2.0.0": "^1.6.9",
+      "socket.io-parser@>=4.0.0 <5.0.0": "^4.2.7",
+      "ip-address@>=10.0.0 <11.0.0": "^10.7.4",
+      "axios@>=1.0.0 <2.0.0": "^1.20.0",
+      "nanoid@>=5.0.0 <6.0.0": "^5.1.16",
+      "nanoid@>=3.0.0 <4.0.0": "^3.3.20",
+      "postcss-selector-parser@>=7.0.0 <8.0.0": "^7.1.6",
+      "browserslist@>=4.0.0 <5.0.0": "^4.29.3",
+      "immutable@>=5.0.0 <6.0.0": "^5.1.9",
+      "colord@>=2.0.0 <3.0.0": "^2.10.0",
+      "baseline-browser-mapping@>=2.0.0 <3.0.0": "^2.11.28",
+      "source-map-js@>=1.0.0 <2.0.0": "^1.2.2",
+      "proxy-addr@>=2.0.0 <3.0.0": "^2.0.8",
+      "compression@>=1.0.0 <2.0.0": "^1.8.2",
+      "handlebars@>=4.0.0 <5.0.0": "^4.7.10",
+      "websocket-driver@>=0.7.0 <0.8.0": "^0.7.5",
+      "@humanfs/node@>=0.16.0 <0.17.0": "^0.16.8",
+      "@xmldom/xmldom@>=0.8.0 <0.9.0": "^0.8.15"
     },
     "ignoredBuiltDependencies": [
       "@parcel/watcher",