Update project dependencies to resolve Dependabot security alerts

Apply the bumps from all 20 open Dependabot security PRs (#1583-#1617)
in one pass on the release branch: axios 1.16.0, ws 8.21.0, the
socket.io server stack, express path-to-regexp, follow-redirects,
lodash and the remaining flagged transitive deps. Angular framework
packages move in lockstep to 20.3.26 and the CLI/build toolchain to
20.3.32, which drops the vulnerable node-forge from the tree entirely.
Also pick up in-range fixes without open PRs (qs, uuid, tough-cookie,
cookie, ajv, bn.js, elliptic, socket.io-parser).

npm audit: 85 vulnerabilities (23 prod) -> 30 (14 prod). The remainder
(request/request-promise, csurf, pdfmake, crypto-browserify chain)
needs code changes, not bumps, and is tracked separately.

Verified: lint, 199 frontend specs, backend + frontend production
builds, and an end-to-end smoke test against the docker regtest
fixture (LND, CLN and Eclair auth/getinfo/channels + WS upgrade).

package.json

@@ -26,7 +26,7 @@
     "@swimlane/ngx-charts": "23.1.0",
     "angular-user-idle": "4.0.0",
     "atob": "2.1.2",
-    "axios": "1.13.2",
+    "axios": "1.16.0",
     "buffer": "6.0.3",
     "cookie-parser": "1.4.7",
     "crypto-browserify": "3.12.1",
@@ -49,30 +49,30 @@
     "stream-browserify": "3.0.0",
     "tslib": "2.8.1",
     "vm-browserify": "1.1.2",
-    "ws": "8.19.0",
+    "ws": "8.21.0",
     "zone.js": "0.16.0"
   },
   "devDependencies": {
-    "@angular-devkit/build-angular": "20.3.14",
+    "@angular-devkit/build-angular": "20.3.32",
     "@angular-eslint/builder": "20.7.0",
     "@angular-eslint/eslint-plugin": "20.7.0",
     "@angular-eslint/eslint-plugin-template": "20.7.0",
     "@angular-eslint/schematics": "20.7.0",
     "@angular-eslint/template-parser": "20.7.0",
-    "@angular/animations": "20.3.14",
-    "@angular/build": "20.3.14",
+    "@angular/animations": "20.3.26",
+    "@angular/build": "20.3.32",
     "@angular/cdk": "20.2.14",
-    "@angular/cli": "20.3.14",
-    "@angular/common": "20.3.14",
-    "@angular/compiler": "20.3.14",
-    "@angular/compiler-cli": "20.3.14",
-    "@angular/core": "20.3.14",
+    "@angular/cli": "20.3.32",
+    "@angular/common": "20.3.26",
+    "@angular/compiler": "20.3.26",
+    "@angular/compiler-cli": "20.3.26",
+    "@angular/core": "20.3.26",
     "@angular/flex-layout": "15.0.0-beta.42",
-    "@angular/forms": "20.3.14",
+    "@angular/forms": "20.3.26",
     "@angular/material": "20.2.14",
-    "@angular/platform-browser": "20.3.14",
-    "@angular/platform-browser-dynamic": "20.3.14",
-    "@angular/router": "20.3.14",
+    "@angular/platform-browser": "20.3.26",
+    "@angular/platform-browser-dynamic": "20.3.26",
+    "@angular/router": "20.3.26",
     "@eslint/eslintrc": "3.3.3",
     "@fortawesome/angular-fontawesome": "4.0.0",
     "@fortawesome/fontawesome-svg-core": "7.1.0",

release-notes/Release-notes-0.15.9.md

@@ -107,6 +107,25 @@ this release should add its entry under the appropriate section below.
 
 ## Code Health
 
+- **Batch dependency update resolving all 20 open Dependabot security PRs**
+  ([#TBD](https://github.com/Ride-The-Lightning/RTL/pull/TBD)).
+  Dependabot had 20 open security-alert PRs against `master` (#1583–#1617). Rather than
+  merging them piecemeal (they conflict with each other on `package-lock.json` and target
+  the wrong branch for the release flow), the same bumps were applied in one pass on the
+  release branch: `axios` 1.16.0 and `ws` 8.21.0 (direct), the socket.io server stack
+  (`engine.io`, `engine.io-client`, `socket.io-adapter`, `socket.io-parser`), express's
+  `path-to-regexp`, `follow-redirects`, `lodash`, and the rest of the flagged transitive
+  deps; the Angular framework packages moved in lockstep to 20.3.26 and the CLI/build
+  toolchain to 20.3.32 (which drops the vulnerable `node-forge` from the tree entirely).
+  In-range fixes Dependabot hadn't re-opened PRs for (`qs`, `uuid`, `tough-cookie`,
+  `cookie`, `ajv`, `bn.js`, `elliptic`) were picked up in the same pass. `npm audit` goes
+  from 85 vulnerabilities (23 production) to 30 (14 production); everything remaining
+  requires code changes, not version bumps — the deprecated `request`/`request-promise`
+  stack, `csurf`, `pdfmake` and the `crypto-browserify` polyfill chain — and is tracked
+  separately. Verified with a clean lint, the full frontend test suite, both production
+  builds, and an end-to-end smoke test of the docker regtest fixture across LND, Core
+  Lightning and Eclair (auth, getinfo, channel lists, and the WebSocket upgrade path).
+
 - **Rebuild the compiled CLN channels controller to match its source**
   ([#1631](https://github.com/Ride-The-Lightning/RTL/pull/1631)).
   The #1606 fix updated `server/controllers/cln/channels.ts` to mirror `peer_connected` onto the