deps: bump file-type 18->21 and uuid 8->11 (Dependabot)

Clears two Dependabot alerts:
- file-type (medium): infinite loop in ASF parser on malformed input — reachable
  via avatar/image upload (fileTypeFromBuffer in lib/upload.ts). -> 21.3.4
- uuid (medium): missing buffer bounds check in v3/v5/v6 when buf is provided —
  we only ever call v4() with no buffer so not actually exposed, bumped anyway. -> 11.1.1

Both are major bumps but drop-in for our usage: project is already ESM
("type":"module") so file-type's ESM-only requirement is fine, and we use the
stable named exports (fileTypeFromBuffer, v4). Verified live: v4() and
fileTypeFromBuffer JPEG detection both work; full app compiles + healthy.

Installed inside the app container (node_modules is root-owned, volume-mounted).
The 4 remaining fastify-family alerts (incl. the critical http-proxy one) need
a fastify 4->5 + 8 plugins lockstep upgrade — deferred to a dedicated window;
real exposure is low behind Cloudflare/Caddy with localhost binding.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2 files changed, 2 insertions, 2 deletions

diff --git a/bun.lockb b/bun.lockb
index 5fb5f0ad..2cbf66f9 100755
--- a/bun.lockb
+++ b/bun.lockb
diff --git a/package.json b/package.json
index e9f46d0d..1cf2b00a 100644
--- a/package.json
+++ b/package.json
@@ -27,7 +27,7 @@
     "clightning-client": "github:asoltys/lightning-client-js#master",
     "date-fns": "^2.30.0",
     "fastify": "^4.29.1",
-    "file-type": "^18.7.0",
+    "file-type": "^21.3.1",
     "fluent-ffmpeg": "^2.1.3",
     "got": "^13.0.0",
     "handlebars": "^4.7.8",
@@ -48,7 +48,7 @@
     "sharp": "^0.33.5",
     "square": "^43.2.1",
     "strfry-rpc": "^0.0.1",
-    "uuid": "^8.3.2",
+    "uuid": "^11.1.1",
     "web-push": "^3.6.7",
     "ws": "^7.5.10"
   },