docs: update accepted security risks

[itsmiso-ai]

Closes #418

[its-saffron]

AI Automated Review

Full PR review.

Analysis engine: MiniMax-M2.7@https://litellm.jory.dev/v1 (anthropic) — routed smart (risk match: file_serving_changes)

Review Summary

Recommendation: Approve — This PR cleanly addresses linked issue PR 418 by retiring two previously accepted npm dependency advisories that are now resolved upstream.

Change Analysis

The PR modifies only SECURITY-ACCEPTED-RISKS.md (a documentation/metadata file) with these changes:

• Adds a "Last updated: 2026-06-17" header
• States there are currently no accepted npm runtime advisories
• Confirms npm audit --omit=dev reports 0 vulnerabilities across 227 production dependencies
• Creates a "Retired Risks" table documenting that the two previously accepted risks (postcss XSS GHSA-qx2v-qp2m-jg93 and hono/node-server bypass GHSA-92pp-h63x-v22m) are now patched upstream
• Removes the verbose detailed descriptions of each risk
• Updates the resolution history table to reflect retired status

Required Checks

Check	Status	Notes
verify file path sanitization	❌ Does not apply	This PR modifies a static markdown documentation file. No file paths are processed, no user input is handled, no file operations occur in code.
check for directory traversal vulnerabilities	❌ Does not apply	Same reasoning — no code changes, no file serving paths, no path processing. The risk flag file_serving_changes is a false-positive classification for this documentation-only change.

Linked Issue Fit

Issue PR 418 requested updating SECURITY-ACCEPTED-RISKS.md to reflect the clean npm audit state or document why advisories remain. This PR does exactly that:

• Confirms 0 vulnerabilities in production dependencies
• Documents that both previously accepted risks (postcss XSS and hono/node-server bypass) are patched upstream
• Provides an audit trail in the retired risks table

Standards Compliance

No repository code conventions apply — this is a documentation-only change.

Evidence Summary

• package.json overrides: Confirms postcss: "^8.5.10" and @hono/node-server: "^2.0.0" are pinned to patched versions
• CI checks: Both Validate and Docker Build completed successfully
• No code changes: Only SECURITY-ACCEPTED-RISKS.md was modified

Unknowns / Needs Verification

None — the PR is self-contained documentation with no executable changes.