fix(deps): upgrade ip-address past the new SSRF advisories

[Astro-Han]

Summary

Release macOS arm64 run 30850257192 failed at npm audit --omit=dev --audit-level=high on three advisories against ip-address <=10.3.0, all high:

• GHSA-mwp4-54f8-5fhr — Address4 decodes leading-zero octets as decimal while resolvers decode them as octal
• GHSA-4xrf-jv44-h6hh — a CIDR suffix suppresses special-use classification
• GHSA-22jq-vg5j-6vgg — IPv4-mapped/NAT64 IPv6 addresses are misclassified

All three bypass SSRF and trust-boundary checks. They were published after #2055 merged, where the same audit reported zero vulnerabilities — this is new advisory data against an unchanged tree, not a regression from that upgrade.

ip-address 10.2.0 → 10.4.0. It is a transitive dependency reached through express-rate-limit (^10.2.0) and socks (^10.1.1); 10.4.0 satisfies both, so this is a lockfile change with no package.json edits.

THIRD_PARTY_NOTICES.txt is regenerated in the same commit, because the release packaging step fails on a stale inventory — that is what broke run 30849279454 after #2055. The notice entry moves to 10.4.0 and its repository URL normalizes from git:// to https://; the license stays MIT.

Verification

• npm audit --omit=dev --audit-level=high: 0 vulnerabilities (was 3 high).
• npm run check:release: all three gates pass — dist fresh, notices current, no dead CSS.
• npm ci then npm run build: clean.
• npm run format:check: clean.

Rollout

Re-dispatch Release macOS arm64 once this is on main and CI is green. No v0.1.4 tag or release exists yet — every failed run stopped before Create draft GitHub Release — so the version does not need another bump.