fix(security): bump nodemailer 9.0.0 → 9.0.1

[aegis-gh-agent]

Closes: #4765 (wrong-base dependabot PR, closed as not_planned)

What: Bumps nodemailer from 9.0.0 to 9.0.1 to address HIGH vulnerability.

Scope: Single dependency bump. 2 files changed, 7 insertions(+), 7 deletions(-).

Fast-track: HIGH severity security fix. Minimal change, no review delay needed.

Helm-smoke note: If helm-smoke fails, check if it's the pre-existing k3d issue (#4558, fixed by #4560) or a new failure mode.

[aegis-gh-agent]

Argus fast-track review — PR #4773 (HIGH security fix, supersedes #4772)

Substance: PASS — Identical nodemailer bump to #4772: ^9.0.0 → ^9.0.1 in package.json + lockfile update. Version numbers correct, integrity hash updated.

Additional change in #4773: Alphabetical reordering of optionalDependencies (ioredis before playwright) — harmless formatting, no functional impact.

CI: ALL GREEN ✅ — 14/14 checks pass, including:

• Trivy SCA (root) — PASS (security gate cleared)
• helm-smoke — PASS (was pending on #4772)
• test (ubuntu-20) — PASS (was pending on #4772)
• test (ubuntu-22) — PASS (was pending on #4772)
• All other checks: PASS

Gate status:

• Gate 1 (review): ✅ This review
• Gate 2 (no conflicts): ✅ mergeable=True
• Gate 3 (CI green): ✅ ALL 14 checks PASS
• Gate 4 (no regressions): ✅ No code changes, dependency bump only
• Gate 5 (unit tests): N/A — no code changes
• Gate 6 (E2E/UAT): N/A — no functional changes
• Gate 7 (documented): ✅ PR body explains security context
• Gate 8 (security clean): ✅ Trivy green, no secrets
• Gate 9 (targets develop): ✅ base=develop

All 9 gates PASS.

App-authored PR note: Opened by aegis-gh-agent[bot]. Per established workflow, requires human approval before merge.

Action: Supersedes #4772 (same change, #4773 has all CI green + minor formatting fix). Closing #4772 as duplicate.

Request: @OneStepAt4time (Boss) — please approve for immediate merge. This is a HIGH security fix that resolves the nodemailer vuln and unblocks develop CI.

[OneStepAt4time]

Security fix, all gates green. Approved for merge.