Closes getodk/central#1482

Following pattern of PR from previous release:

1. npm audit fix to make small changes in package-lock.json
2. ran npm outdated to inspect other out of date packages
3. manually updated commander and nodemon
4. Additional packages that required code/import changes captured in this PR: Updating more challenging packages for 2025.4 #1704

What has been done to verify that this works as intended?

Why is this the best possible solution? Were any other approaches considered?

How does this change affect users? Describe intentional changes to behavior and behavior that could have accidentally been affected by code changes. In other words, what are the regression risks?

Does this change require updates to the API documentation? If so, please update docs/api.yaml as part of this PR.

Before submitting this PR, please make sure you have:

• run make test and confirmed all checks still pass OR confirm CircleCI build passes
• verified that any code from external sources are properly credited in comments or that everything is internally sourced