release: v4.8.9 security hardening patch

- upgrade DOMPurify to patched release (fixes high-severity XSS GHSA-87xg-pxx2-7hvx)
- upgrade esbuild build dependency; npm audit now reports 0 vulnerabilities
- stop tracking config/ice-servers.js (TURN credentials); add example template
- production logger no longer prints error context or info/debug output
- bump version to 4.8.9 across header, manifest, README, init message
- update SECURITY.md supported-release table to v4.8.x

.gitignore

@@ -4,3 +4,9 @@ node_modules/
 # Local environment noise
 .npm/
 npm-debug.log*
+.DS_Store
+**/.DS_Store
+
+# Operator ICE override holds TURN credentials — never commit it.
+# Use config/ice-servers.example.js as the template.
+config/ice-servers.js