Reduce dependency vulnerability backlog and unblock Dependabot version updates

## Summary
OpenSSF Scorecard (2026-08-07 run, https://scorecard.dev/viewer/?uri=github.com/airqo-platform/AirQo-api) flags:
- **Vulnerabilities: 0/10** — 558 existing vulnerabilities detected across dependencies
- **Dependency-Update-Tool: 10/10** — Dependabot is active, but version-update PRs aren't translating into a shrinking backlog

Additionally, `AirQo-frontend/.github/dependabot.yml` currently sets `open-pull-requests-limit: 0` for the `src/platform/` npm ecosystem, which silences all version-update PRs for the main frontend workspace.

## Tasks
- [ ] Triage the current Dependabot/npm-audit alert list across microservices and prioritize by severity (critical/high first)
- [ ] Establish an SLA for patching critical/high vulnerabilities (e.g., 7/30 days per SECURITY.md's spirit)
- [ ] Raise `open-pull-requests-limit` in `AirQo-frontend/.github/dependabot.yml` above 0 (or file a companion issue in `AirQo-frontend`) so version-update PRs actually open
- [ ] Re-run Scorecard after remediation and confirm the Vulnerabilities score improves

## Why this matters
This is our lowest-scoring Scorecard check and the most concrete, measurable gap heading into the next Secure Open Source Fund check-in.

## References
- Scorecard check: `Vulnerabilities` (score 0), `Dependency-Update-Tool` (score 10)
- `AirQo-frontend/.github/dependabot.yml`