fix: update form-data and multer to address security vulnerabilities

- Update form-data from 4.0.3 to 4.0.4 (fixes CVE GHSA-fjxv-7rqg-78g4)
- Update multer from 2.0.1 to 2.0.2 (fixes CVE GHSA-fjgf-rc76-4x9p)
- Both backend and frontend now have 0 vulnerabilities
- Tested upload functionality - all working correctly

These are patch updates with no breaking changes. The updates address:
- form-data: Critical vulnerability - unsafe random function for boundary
- multer: High vulnerability - DoS via unhandled exception

🤖 Generated with Claude Code

Co-Authored-By: Claude <noreply@anthropic.com>

backend/package-lock.json

@@ -21,7 +21,7 @@
         "express": "^4.18.2",
         "express-rate-limit": "^6.7.0",
         "express-validator": "^7.0.1",
-        "form-data": "^4.0.3",
+        "form-data": "^4.0.4",
         "handlebars": "^4.7.8",
         "helmet": "^7.0.0",
         "i18next": "^25.3.1",
@@ -32,7 +32,7 @@
         "jsonwebtoken": "^9.0.0",
         "knex": "^2.4.2",
         "mime-types": "^3.0.1",
-        "multer": "^2.0.1",
+        "multer": "^2.0.2",
         "node-cron": "^3.0.2",
         "nodemailer": "^6.9.1",
         "pg": "^8.16.3",
@@ -5446,9 +5446,9 @@
       }
     },
     "node_modules/form-data": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.3.tgz",
-      "integrity": "sha512-qsITQPfmvMOSAdeyZ+12I1c+CKSstAFAwu+97zrnWAbIr5u8wfsExUzCesVLC8NgHuRUqNN4Zy6UPWUTRGslcA==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.4.tgz",
+      "integrity": "sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==",
       "license": "MIT",
       "dependencies": {
         "asynckit": "^0.4.0",
@@ -7720,9 +7720,9 @@
       "license": "MIT"
     },
     "node_modules/multer": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/multer/-/multer-2.0.1.tgz",
-      "integrity": "sha512-Ug8bXeTIUlxurg8xLTEskKShvcKDZALo1THEX5E41pYCD2sCVub5/kIRIGqWNoqV6szyLyQKV6mD4QUrWE5GCQ==",
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/multer/-/multer-2.0.2.tgz",
+      "integrity": "sha512-u7f2xaZ/UG8oLXHvtF/oWTRvT44p9ecwBBqTwgJVq0+4BW1g8OW01TyMEGWBHbyMOYVHXslaut7qEQ1meATXgw==",
       "license": "MIT",
       "dependencies": {
         "append-field": "^1.0.0",

backend/package.json

@@ -28,7 +28,7 @@
     "express": "^4.18.2",
     "express-rate-limit": "^6.7.0",
     "express-validator": "^7.0.1",
-    "form-data": "^4.0.3",
+    "form-data": "^4.0.4",
     "handlebars": "^4.7.8",
     "helmet": "^7.0.0",
     "i18next": "^25.3.1",
@@ -39,7 +39,7 @@
     "jsonwebtoken": "^9.0.0",
     "knex": "^2.4.2",
     "mime-types": "^3.0.1",
-    "multer": "^2.0.1",
+    "multer": "^2.0.2",
     "node-cron": "^3.0.2",
     "nodemailer": "^6.9.1",
     "pg": "^8.16.3",