fix(deps): patch deepmerge-ts to 8.0.1 and document extract-zip residual

修复 GHSA-ggr8-5vv4-36mx（deepmerge-ts 栈爆破）via overrides.deepmerge-ts=^8.0.1，
已验证 prisma validate/generate 与全量单测通过、依赖树无 invalid。剩余 extract-zip
high（GHSA-jmr9-qjv8-65gv）为 @lhci/cli dev 工具链且无非破坏性补丁，记录为已知
dev 残留；生产依赖 npm audit --omit=dev 为 0 漏洞。

package.json

@@ -35,6 +35,7 @@
     "test:e2e:fast": "cd e2e && npx playwright test --grep '@smoke|@critical'",
     "test:e2e:standard": "cd e2e && npx playwright test --grep @regression",
     "test:e2e:journey": "cd e2e && npx playwright test --grep @journey",
+    "test:e2e:journey:home": "cd e2e && npx playwright test uj-11-home-conversion.spec.ts --project=chromium --project=chromium-mobile",
     "test:e2e:mobile": "cd e2e && npx playwright test --grep @mobile",
     "test:e2e:mobile:performance": "cd e2e && npx playwright test --grep @mobile.*@performance",
     "test:e2e:mobile:accessibility": "cd e2e && npx playwright test --grep @mobile.*@accessibility",
@@ -160,6 +161,8 @@
     "ws": "^8.21.1",
     "esbuild": "^0.28.1",
     "glob": "^13.0.6",
-    "sharp": "^0.35.3"
+    "sharp": "^0.35.3",
+    "qs": "^6.15.2",
+    "deepmerge-ts": "^8.0.1"
   }
 }