fix: upgrade Express security dependency chain

[Joncallim]

Summary

• upgrade the API workspace from Express 4.22.2 to 5.2.1, which resolves its qs chain at 6.16.0
• retain route-manifest inspection across Express 5 app.router and legacy _router without changing request routes, auth, or runtime behavior
• keep the planted untracked-layer regression effective under the active router location

Audit evidence

• Before: npm audit --omit=dev reported 3 moderate production findings: qs@6.15.2, propagated through Express 4/body-parser.
• After: npm audit --omit=dev --json reports 0 production vulnerabilities; npm ls qs --all resolves Express 5.2.1 → body-parser 2.3.0 → qs 6.16.0 with no invalid dependencies.
• Separate dev-only note: plain npm ci continues to report 3 high findings in development dependencies; they are outside --omit=dev and are not changed by this production chain remediation.

Verification

• npm ci --ignore-scripts
• npm audit --omit=dev --json
• npm run typecheck
• npm run test:api (73/73)
• npm run build
• git diff --check

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T15:55:45.901921Z	9a6f06d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9a6f06d9f4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Handle Express 5 listen errors

When startup encounters a bind failure such as EADDRINUSE or EACCES, Express 5 passes the error to the app.listen callback instead of throwing it. The callback in apps/api/src/index.ts ignores its argument and always logs that the API is listening, consuming the failure and allowing the process to exit successfully; because deploy/systemd/dockermap-api.service uses Restart=on-failure, the deployed API will remain down rather than restart. Update the Express type declarations to v5 and make the callback preserve a nonzero startup failure.

Useful? React with 👍 / 👎.