Close two high advisories on the outbound path

`undici` moves to 8.10.0 and the `fast-uri` override rises to 3.1.5. Both were
published as high after the last run on the trunk, so this is new information
rather than neglect, and both matter here: undici is what backs `safeFetch`,
which is the one documented egress boundary and the place the connect-time
DNS-rebinding pin lives.

The undici advisory is a cross-user information disclosure and a parse-time
crash through degenerate private cache directives. `fast-uri` arrives four ways
through transitive dependencies and the existing override was pinned one patch
short of the fix.

The safe-fetch dispatcher suite passes against the new client, which is the
part that had to be checked rather than assumed: the pin reaches into undici's
connect hook and a client bump is exactly where that could quietly stop being
enforced.

package.json

@@ -98,7 +98,7 @@
     "sonner": "^2.0.7",
     "tailwind-merge": "^3.6.0",
     "tesseract.js": "^7.0.0",
-    "undici": "^8.5.0",
+    "undici": "^8.10.0",
     "web-push": "^3.6.7",
     "yaml": "^2.8.4",
     "zod": "^4.4.3",