fix(backend): bump sharp, nodemailer, multer, js-yaml, joi for security fixes (stable) (#1375)

* fix(backend): bump sharp, nodemailer, multer, js-yaml, joi for security fixes

Backport of the same dependency bump on main (#1374). Resolves the
same 12 code-scanning alerts flagged on stable's backend deps: sharp
libheif RCE, nodemailer address-parser ReDoS + domain-validation
bypasses, multer upload DoS/race conditions, js-yaml parsing DoS, and
joi prototype pollution. All patch/minor bumps within the currently
used major version.

* fix(backend): set multer's fieldArrayIndexLimit to actually close CVE-2026-82333

The advisory is explicit that the 2.3.0 version bump alone doesn't
remediate the array-index DoS — an app must also set
limits.fieldArrayIndexLimit. Set it on every multer instance, sized to
what each route's form actually needs.

---------

Co-authored-by: Paul Nothaft <[email protected]>

backend/package.json

@@ -46,7 +46,7 @@
     "knex": "^2.4.2",
     "mailparser": "^3.9.9",
     "mime-types": "^3.0.1",
-    "multer": "2.2.0",
+    "multer": "2.3.0",
     "node-cron": "^3.0.2",
     "node-stream-zip": "^1.15.0",
     "nodemailer": "^9.0.1",
@@ -59,7 +59,7 @@
     "qrcode": "^1.5.4",
     "react-i18next": "^15.6.0",
     "sanitize-html": "2.17.7",
-    "sharp": "0.35.3",
+    "sharp": "0.35.4",
     "sqlite3": "^5.1.6",
     "swagger-jsdoc": "^6.2.8",
     "swagger-ui-express": "^5.0.1",