[HIGH] fix: update lodash to 4.18.1

[OskarEichler]

Summary

• update the direct runtime dependency from Lodash 4.17.21 to 4.18.1
• refresh the lockfile to resolve the patched release
• clear the production dependency audit

Security impact

The default template loader imports lodash/template, so Lodash is part of this package’s runtime path rather than a development-only dependency. The previous locked release is affected by published high-severity code-injection and moderate-severity prototype-pollution advisories.

Verification

• npm audit --omit=dev: 0 vulnerabilities
• npm run lint: passed
• npm run test:only -- --runInBand: 4 suites and 161 tests passed
• git diff --check: passed

The repository’s existing npm test post-test TypeScript check still fails at index.js:959 with TS2802; that baseline failure is unrelated to this dependency-only change.