chore: bump nodemailer v6 -> v9 (resolves high-severity advisories)

createTransport()/sendMail() callback API unchanged between majors - smoke
tested the transport directly (confirmed correct error type, not an API
shape error) since the test suite doesn't exercise the email-sending path
(EMAIL_VERIFICATION off in tests). Full build + 179-test suite still pass.

3 unique vulnerable packages remain (aws-sdk's own advisory + its nested
uuid, vite/esbuild dev-server issue needing a major v5->v8 bump) - left
deliberately, all lower practical risk or need a dedicated upgrade pass.

package-lock.json

@@ -38,7 +38,7 @@
         "lodash.debounce": "^4.0.8",
         "mongodb": "^6.21.0",
         "mongoose": "^8.4.1",
-        "nodemailer": "^6.9.14",
+        "nodemailer": "^9.0.3",
         "normalize.css": "^8.0.1",
         "password-prompt": "^1.1.2",
         "progress-stream": "^2.0.0",
@@ -85,7 +85,7 @@
         "@types/jsonwebtoken": "^8.3.9",
         "@types/lodash": "^4.17.5",
         "@types/node": "^20.14.2",
-        "@types/nodemailer": "^6.4.15",
+        "@types/nodemailer": "^8.0.1",
         "@types/prompts": "^2.4.9",
         "@types/react": "^18.3.3",
         "@types/react-dom": "^18.3.0",
@@ -4895,9 +4895,9 @@
       }
     },
     "node_modules/@types/nodemailer": {
-      "version": "6.4.17",
-      "resolved": "https://registry.npmjs.org/@types/nodemailer/-/nodemailer-6.4.17.tgz",
-      "integrity": "sha512-I9CCaIp6DTldEg7vyUTZi8+9Vo0hi1/T8gv3C89yk1rSAAzoKQ8H8ki/jBYJSFoH/BisgLP8tkZMlQ91CIquww==",
+      "version": "8.0.1",
+      "resolved": "https://registry.npmjs.org/@types/nodemailer/-/nodemailer-8.0.1.tgz",
+      "integrity": "sha512-PxpaInm8V1JQDd4j0ds5HfvWQk8JupS1C0Picb96QJsrrRDjBH+DlK7L4ZdNSqNULhiZRQHc40nLVShaGxXAMw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -11819,9 +11819,9 @@
       "license": "MIT"
     },
     "node_modules/nodemailer": {
-      "version": "6.10.1",
-      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-6.10.1.tgz",
-      "integrity": "sha512-Z+iLaBGVaSjbIzQ4pX6XV41HrooLsQ10ZWPUehGmuantvzWoDVBnmsdUcOIDM1t+yPor5pDhVlDESgOMEGxhHA==",
+      "version": "9.0.3",
+      "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-9.0.3.tgz",
+      "integrity": "sha512-n+YP+NKwR5zRWa60k3GiQ6Q3B4KXCoAw40dAKeCtYn020iNN74aWK2liXIC3ZEATeGql7we3tE3t8QwhY0eskw==",
       "license": "MIT-0",
       "engines": {
         "node": ">=6.0.0"

package.json

@@ -50,7 +50,7 @@
     "lodash.debounce": "^4.0.8",
     "mongodb": "^6.21.0",
     "mongoose": "^8.4.1",
-    "nodemailer": "^6.9.14",
+    "nodemailer": "^9.0.3",
     "normalize.css": "^8.0.1",
     "password-prompt": "^1.1.2",
     "progress-stream": "^2.0.0",
@@ -97,7 +97,7 @@
     "@types/jsonwebtoken": "^8.3.9",
     "@types/lodash": "^4.17.5",
     "@types/node": "^20.14.2",
-    "@types/nodemailer": "^6.4.15",
+    "@types/nodemailer": "^8.0.1",
     "@types/prompts": "^2.4.9",
     "@types/react": "^18.3.3",
     "@types/react-dom": "^18.3.0",