fix(demos): apply npm audit fix to trading-agent and demo_notif_app

[memosr]

Summary

npm audit fix without --force, run with --package-lock-only, so only the two lockfiles change. No package.json, no application code.

App	before	after
agents/trading-agent	3 (1 critical, 1 high, 1 low)	1 (low)
apps/demo_notif_app	15 (11 high, 3 moderate, 1 low)	5 (4 high, 1 moderate)

Counts are from npm audit --package-lock-only against current master, re-run for this revision.

Direct dependencies that moved

• agents/trading-agent: handlebars 4.7.8 -> 4.7.9
• apps/demo_notif_app: viem 2.47.12 -> 2.56.3

Everything else in the diff is transitive.

Verification

npm ci && npm run build passes in both apps.

What is left

What npm audit fix cannot reach without a major bump: trading-agent keeps one low esbuild advisory that only affects the dev server on Windows, and demo_notif_app keeps four advisories whose only fix path is breaking.

Not included: base-account/agent-spend-permissions

Its remaining high advisories all come from @coinbase/cdp-sdk's old Solana stack, and the only fix npm audit offers is cdp-sdk 1.55.0. From 1.53.0 onward the SDK declares @x402/svm as an optional peer dependency but imports it unconditionally from _esm/actions/x402/signX402Payment.js, so next build fails:

./node_modules/@coinbase/cdp-sdk/_esm/actions/x402/signX402Payment.js
Module not found: Can't resolve '@x402/svm/exact/client'

cdp-sdk 1.38.4 through 1.52.0 carry the Solana fix without that import, but the app declares @coinbase/cdp-sdk, @x402/evm and @x402/fetch as latest, so a lockfile pin alone would not survive a fresh npm install. That app needs its own change and is left out here.