[Am1nCmd]

Summary

• Update DOMPurify 3.4.16 to 3.4.17.
• Update concurrently 10.0.5 to 10.0.6, bringing its pinned shell-quote dependency from 1.9.0 to 1.12.0.
• Keep the change limited to package.json and package-lock.json, with no major upgrades.

Verification

• Clean npm ci --ignore-scripts succeeds.
• npm audit: critical findings reduced from 3 to 0; existing 4 high, 7 moderate, and 2 low findings are out of scope.
• npm audit --omit=dev: 0 findings. Note: browser libraries bundled from devDependencies still need the full audit.
• npm run typecheck passes.
• npm test: 614 passed, 0 failed.
• npm run build passes.
• Chromium smoke verifies DOMPurify 3.4.17 preserves safe markup and strips executable markup.
• concurrently successfully runs two Node child commands.
• Independent diff review passes.