chore(deps): bump @types/node, dotenv, knip and express (dev only)

[vvillait88]

Summary

Dev dependency patch and minor bumps from today's maintenance sweep: @types/node 26.6.5, dotenv 18.0.7, knip 6.41.0 and express 5.3.0 (dev only; the peer range is unchanged), raising each floor to the new version. The lockfile moves only those packages and knip's own dependency tree (the oxc-parser bindings, formatly, unbash) and express's own dependencies (content-type, content-disposition). No runtime dependency changes. Worked with Varun. Held majors (eslint 10, typescript 7) stay held per the holds registry.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None. Only dev dependencies changed, so the published package is unchanged and no release is needed.

Test plan

bun install reinstalled, then lint, typecheck and the full test suite ran locally and passed.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (nothing public changed)
• No secrets, credentials, or personal data in the diff or the tests