fix: resolve critical fast-xml-parser vulnerability and block deploy on audit

- Override fast-xml-parser to ^5.3.6 (fixes CVE-2026-25896, CVE-2026-26278, CVE-2026-25128)
- Add security-audit to deploy job dependencies in quality-gate workflow

.github/workflows/quality-gate.yml

@@ -117,7 +117,7 @@ jobs:
   deploy:
     name: Deploy Web
     runs-on: ubuntu-latest
-    needs: [web, mobile]
+    needs: [web, mobile, security-audit]
     if: github.ref == 'refs/heads/main' && github.event_name == 'push'
 
     steps:

mobile/package.json

@@ -95,7 +95,8 @@
     "@pezkuwi/keyring": "^14.0.25",
     "@pezkuwi/util": "^14.0.25",
     "@pezkuwi/util-crypto": "^14.0.25",
-    "@isaacs/brace-expansion": "5.0.1"
+    "@isaacs/brace-expansion": "5.0.1",
+    "fast-xml-parser": "^5.3.6"
   },
   "devDependencies": {
     "@babel/plugin-transform-class-static-block": "^7.28.6",