npm Audit Fix Loop

Fix high/critical npm audit findings one at a time with test verification — not a blind npm audit fix --force.