fix: resolve audit vulnerabilities and stabilize CI test startup

- add npm overrides for diff, serialize-javascript and uuid so
  transitive dev-dependency advisories are resolved (npm audit: 0 vulns)
- replace fixed 2800ms server-startup delay in tests with active
  health-endpoint polling to remove CI flakiness on slow runners

Author: claude