chore(deps): upgrade uuid to v14

[orien]

Context

The project depends on uuid ^8.3.1. It uses a single symbol — import { v4 as uuidv4 } from 'uuid' — to generate instance and node IDs.

Version 8 is no longer maintained. The uuid team currently ships fixes only for latest (v14) plus three backport lines, exposed as the legacy-11 (11.1.1), legacy-12 (12.0.1), and legacy-13 (13.0.2) npm dist-tags; majors at or below v10 receive no updates. That gap matters here because all uuid releases before 11.1.1 (8.3.1 among them) are affected by CVE-2026-41907: a missing buffer bounds check in the v3/v5/v6 functions when a buf argument is supplied, allowing an out-of-bounds write (CWE-787, CVSS 7.5). The fix was backported as far as 11.1.1 — the oldest still-maintained line — and never to v8. This project only calls v4() with no buffer, so the flaw is not exploitable in our usage, but the unmaintained, affected version still surfaces in dependency audits.

Changes

• Upgrade uuid to ^14, moving onto a maintained major and clearing the affected version. The runtime source is unchanged; the v4 import is stable across v8→v14 and the library build (tsc) passes untouched.
• jest.config.json: map the bare uuid import to its entry file (Jest 24 predates the exports field) and add uuid to the transformIgnorePatterns exception so Babel transpiles its ESM.
• jest/setup.ts: polyfill the Web Crypto API in the jsdom environment, which uuid v14 relies on for getRandomValues/randomUUID.

Considerations

• The test harness runs on Jest 24 (ts-jest/babel-jest at the same major), which predates the package exports field and does not provide the Web Crypto API in its jsdom environment. uuid dropped CommonJS in v12 and is ESM-only from there on, which is why the harness — not the source — required adaptation.
• These config workarounds are the pragmatic fix; a future Jest upgrade would let uuid resolve natively without the moduleNameMapper mapping.
• A separate transitive uuid@3.4.0 still reaches the tree via coveralls > request; it is unaffected by this change and would be cleared by upgrading those dev dependencies.
• Verified: npm run build passes and npm test passes all 4 suites (79 passed, 2 pre-existing skips).