chore: drop unused chai-http and socket.io-client devDependencies

[TheLastCicada]

Follow-up to #1745, which deleted the last consumers of both packages.

Based on test/v1-cleanup-redundant-specs rather than v2-rc2, because the
dependencies are still in use on v2-rc2 — removing them there would break the
suite. GitHub will retarget this to v2-rc2 automatically once #1745 merges.
Merge #1745 first.

Why these two

• chai-http — only consumer was tests/utils/request-utils.js, a helper with
  zero importers. HTTP assertions everywhere else in the suite go through
  supertest, which stays.
• socket.io-client — only consumer was tests/resources/updates.spec.js,
  socket.io library boilerplate that never imported CADT code.

A repo-wide search (excluding node_modules and package-lock.json) finds no
remaining reference to chai-http, chai.request, or socket.io-client.

The runtime socket.io dependency used by src/server.js is untouched.

Lockfile

npm uninstall --save-dev produced deletions only — no version churn on any
other package. Sixteen entries drop out, chai-http and socket.io-client plus
their exclusive transitives:

@types/cookiejar, @types/methods, @types/superagent, chai-http,
charset, clone-regexp, convert-hrtime, engine.io-client,
function-timeout, ip-regex, is-ip, is-regexp, socket.io-client,
super-regex, time-span, xmlhttprequest-ssl

Verification

• npm ci from the regenerated lockfile succeeds, so package.json and
  package-lock.json agree
• npm run test:v1 — 153 passing, 5 pending
• npm run test:v2 — 1751 passing
• Both package.json and package-lock.json parse as valid JSON

Note

oss-attribution/attributions.txt still lists socket.io-client, but that file
is a stale generated snapshot — it records both socket.io and
socket.io-client at 4.5.1 while package.json pins ^4.8.3. It is clearly
regenerated out of band rather than per-PR, so it is left alone here.

---

Note

Low Risk
Dev-only dependency cleanup with no runtime or test-code changes; packages had no remaining importers.

Overview
Removes unused chai-http and socket.io-client from devDependencies after their last consumers were deleted.

Also drops their exclusive transitive packages from the lockfile. Runtime socket.io is unchanged; HTTP tests continue to use supertest.

^{Reviewed by Cursor Bugbot for commit 126dafb. Bugbot is set up for automated code reviews on this repo. Configure here.}