Audit my Node.js app for prototype pollution vulnerabilities and fix them. Look for every place user-controlled data gets merged, assigned, or extended into an object: recursive merge helpers, Object.assign on request bodies, lodash merge/defaultsDeep calls, custom deep-set functions that build nested objects from dotted keys, and any code that reads keys from req.body or req.query and uses them as property names. For each one, block the dangerous keys: __proto__, constructor, and prototype. Prefer one of these fixes per site: use a safe merge that skips those keys, create the target object with Object.create(null) when it is a plain data bag, validate the input against a schema before merging, or use Map for arbitrary key-value storage. If a dependency merge call is the problem, check whether a patched version exists and upgrade it. Do not change the shape of the data my API accepts. Legitimate nested updates should keep working exactly as before. Do not strip any keys other than __proto__, constructor, and prototype paths. List each merge point you found, which fix you applied, and give me a test payload for each one that would have polluted Object.prototype before the fix and is now safely ignored.