release: v4.8.9 security hardening patch

- upgrade DOMPurify to patched release (fixes high-severity XSS GHSA-87xg-pxx2-7hvx)
- upgrade esbuild build dependency; npm audit now reports 0 vulnerabilities
- stop tracking config/ice-servers.js (TURN credentials); add example template
- production logger no longer prints error context or info/debug output
- bump version to 4.8.9 across header, manifest, README, init message
- update SECURITY.md supported-release table to v4.8.x

meta.json

@@ -1,10 +1,10 @@
 {
-  "version": "1779848383991",
-  "buildVersion": "1779848383991",
-  "appVersion": "4.8.8",
-  "buildTime": "2026-05-27T02:19:44.033Z",
-  "buildId": "1779848383991-2468cb4",
-  "gitHash": "2468cb4",
+  "version": "1781550335673",
+  "buildVersion": "1781550335673",
+  "appVersion": "4.8.9",
+  "buildTime": "2026-06-15T19:05:35.714Z",
+  "buildId": "1781550335673-d11f250",
+  "gitHash": "d11f250",
   "generated": true,
-  "generatedAt": "2026-05-27T02:19:44.035Z"
+  "generatedAt": "2026-06-15T19:05:35.717Z"
 }