deps: bump brace-expansion to 5.0.9

[GSTJ]

Summary

We bumped brace-expansion to 5.0.9, clearing the new high-severity denial-of-service advisory across every transitive path.

Details

• Updates the root override and lockfile from 5.0.8 to 5.0.9 for GHSA-rgw5-rvv9-x895.
• Keeps the compatibility patches for minimatch 3 and 9, and updates their security rationale.

Testing steps

1. Run:

pnpm audit --prod --audit-level low && pnpm test

2. Confirm the audit prints No known vulnerabilities found and the command exits successfully.

[GSTJ]

Local proof from 87d2ebf: the production audit is clear, 5.0.9 expands ranges correctly, and the full API and mobile suites pass.