chore(cutover): the ui root's wait-on devDependency moves to ^9.5.1, off the axios and joi advisories (bill item 40, objectstack#25803)

wait-on 9.1.0 pulled axios 1.18.1 (14 advisories, fixed in 1.20.0) and joi 18.2.3 (4 advisories,
fixed in 18.2.9) into the merged lock, which Validate Package Dependencies reads against main's
lock as introduced. 9.5.1 resolves axios 1.20.0 and joi 18.3.0. Dev tooling only (the e2e
server wait); nothing published depends on it.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CUXv64KLMfYv3ia2sWi6te

Author: claude

ui/package.json

@@ -181,7 +181,7 @@
     "vite-plugin-compression2": "^2.5.3",
     "vitest": "^4.1.10",
     "vitest-axe": "^0.1.0",
-    "wait-on": "^9.1.0",
+    "wait-on": "^9.5.1",
     "yaml": "^2.9.0"
   },
   "msw": {