Upgrade Express and audit dependencies

[mquan]

Description

• upgrade Express from v4 to v5.2.1 so the dependency tree can use the patched qs release
• upgrade Vitest and coverage to 4.1.11
• raise the Node type floor to 20.19.0 for Vite compatibility
• refresh vulnerable transitive dependencies; npm audit now reports zero vulnerabilities

The lockfile was generated with npm 11 because npm 10.9.2 crashes in Arborist with Cannot read properties of null (reading edgesOut) while resolving this graph.

How was this change tested?

• Automated test (unit, integration, etc.)
• Manual test (provide reproducible testing steps below)

npm test — 12 files, 109 tests passed

npm run build — passed

npm audit — found 0 vulnerabilities

Screenshots

N/A (dependency-only change)