Resolve open Dependabot vulnerability alerts #139

Context

There are open Dependabot alerts (https://github.com/InditexTech/weavejs-backend/security/dependabot) affecting ip-address, undici and brace-expansion, up to high severity.

Analysis

• code/: the vulnerable copies live only inside the bundled node_modules of the npm package, which is declared as a dependency in code/package.json. The application's own copies are already patched. Nothing in the source, scripts, CI or Dockerfile uses the npm package; it appears to have been added by accident together with the unrelated install package. Removing it should close these alerts.
• cleanup-storage/: brace-expansion 1.1.18 and 2.1.4 are pulled in through the dev-only eslint/prettier/glob chain. A lockfile update should fix them, with no runtime exposure.

Tasks

• Remove the unused npm dependency (and the likely accidental install dependency) from code/package.json
• Update brace-expansion (and minimatch/glob if needed) in cleanup-storage/
• Run lint and build in both folders (npm run verify in code/)
• Confirm the alerts are closed after merge
• Consider grouped Dependabot updates for both npm folders to avoid recurrence