express@4.19.2 ships a known vulnerability (GHSA-qw6h-vgh9-j6wx)

Fix this high-severity security issue: express@4.19.2 ships a known vulnerability (GHSA-qw6h-vgh9-j6wx).

## What's wrong
express vulnerable to XSS via response.redirect()
Untrusted input enters through dependency express (`package.json:1`) and reaches `package.json:1`.
Who can pull this off: The application pulls this dependency in at runtime.

## Path from input to impact
1. `package.json:1` — Declared dependency express@4.19.2

## Proof it's real
```
Upgrade or patch express past the version affected by GHSA-qw6h-vgh9-j6wx.
```

## How to close it
Bump express to the release that fixes GHSA-qw6h-vgh9-j6wx.

## The fix has to
- GHSA-qw6h-vgh9-j6wx no longer applies to the installed version of express

## Leave alone
- The application still builds and its test suite still passes

## Prove it with this test
```
Re-run the dependency audit and confirm GHSA-qw6h-vgh9-j6wx is cleared for express.
```

Start by getting the regression test to fail against the code as it stands today. Then apply the narrowest change that shuts the attack path, and confirm that same test — plus the rest of the suite — now passes.