chore(deps): refresh frontend dependencies

[dependabot]

Summary

• updates all direct frontend dependencies and refreshes the full npm lockfile
• migrates react-router-dom 7 to react-router 8.3.0, including import updates
• updates Vite configuration for its native config loader
• adds pinned backend development dependencies so Ruff releases cannot silently change CI lint policy

Security

• resolves the npm advisories currently reported by npm audit, including the React Router, Hono, PostCSS, brace-expansion, fast-uri, js-yaml, Undici, and Babel findings
• npm audit --audit-level=low reports 0 vulnerabilities

Verification

• npm ci
• npm run lint
• npm run test — 32 passed
• npm run build
• ruff check backend/
• pytest backend/tests — 92 passed

Compatibility note

TypeScript remains on 6.0.3 because the current typescript-eslint release supports TypeScript <6.1; moving to TypeScript 7 now would create an invalid peer dependency tree.

[RyleaStark]

I expanded this from the original grouped Dependabot bump into a full frontend dependency refresh. It now includes the remaining direct package updates, migrates React Router to 8.3.0 to clear the newest advisory, refreshes vulnerable transitive packages, and pins the backend CI tools so Ruff 0.16 cannot unexpectedly redefine the lint gate.

Local verification is green:

• frontend lint
• 32 frontend tests
• production frontend build
• npm audit: 0 vulnerabilities
• backend Ruff check
• 92 backend tests

CI is green on the updated branch, including the container build. After this lands, I’ll keep the riskier backend runtime dependency refresh as the next stacked PR rather than mixing it into this frontend/security change.