build(deps): cherry-pick 12 dependabot PRs (pick-me)

[Copilot]

Cherry-picks all 12 PRs labelled pick-me onto main, in conflict-minimising order.

For single-page-app/ui/yarn.lock (touched by two PRs), the commit touching the higher line numbers (#1144, line ~4070) was applied before the one touching lower lines (#1155, line ~3994) — both merged cleanly with no conflicts.

Commits included

PR	Change
#1125	bump node in /shared/node
#1129	bump nginx in /local_ratelimit
#1137	bump github.com/envoyproxy/envoy in /golang-http/simple
#1141	bump psycopg2-binary in /shared/python/postgres
#1144	bump react 19.2.4→19.2.5 in /single-page-app/ui
#1146	bump mysql 9.6.0→9.7.0 in /mysql
#1148	bump otel/opentelemetry-collector in /opentelemetry
#1150	bump openpolicyagent/opa in /ext_authz
#1151	bump google.golang.org/grpc in /ext_authz/auth/grpc-service
#1152	bump google.golang.org/grpc in /load-reporting-service
#1153	bump google.golang.org/grpc in /grpc-bridge/server
#1155	bump postcss 8.5.8→8.5.13 in /single-page-app/ui

All 12 applied with zero conflicts.