fix: correct URL dep depth and add error handling

- Record child dependency depth instead of parent depth
- Surface scan failures instead of silently returning empty array

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: ndpvt-web

server/utils/dependency-analysis.ts

@@ -297,19 +297,24 @@ async function scanUrlDependencies(
           ...versionData.optionalDependencies,
         }
 
+    // URL dependencies are children of the current package, so their depth is one level deeper
+    const dependencyDepth: DependencyDepth = depth === 'root' ? 'direct' : 'transitive'
+
     for (const [depName, depUrl] of Object.entries(allDeps || {})) {
       if (isUrlDependency(depUrl)) {
         urlDeps.push({
           name: depName,
           url: depUrl,
-          depth,
+          depth: dependencyDepth,
           path: [...path, `${depName}@${depUrl}`],
         })
       }
     }
 
     return urlDeps
-  } catch {
+  } catch (error) {
+    // oxlint-disable-next-line no-console -- log URL dependency scan failures for debugging
+    console.warn(`[dep-analysis] URL dependency scan failed for ${name}@${version}:`, error)
     return []
   }
 }