Bump major dependencies: express 5, csv-parse 6, dotenv 17, multer 2

All APIs compatible with existing code. Added quiet:true to dotenv config
to suppress the new startup log message added in dotenv 17.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

api/server.js

@@ -3,7 +3,7 @@
  * Simple REST API for data transformation
  */
 
-require('dotenv').config();
+require('dotenv').config({ quiet: true });
 const express = require('express');
 const { Pool } = require('pg');
 

package.json

@@ -18,10 +18,10 @@
   "license": "MIT",
   "dependencies": {
     "bcrypt": "^6.0.0",
-    "csv-parse": "^5.5.2",
-    "dotenv": "^16.3.1",
-    "express": "^4.18.2",
-    "multer": "^1.4.5-lts.1",
+    "csv-parse": "^6.2.1",
+    "dotenv": "^17.4.2",
+    "express": "^5.2.1",
+    "multer": "^2.1.1",
     "pg": "^8.21.0"
   },
   "devDependencies": {