chore(deps): batch Dependabot bumps into a single PR

Consolidate 22 open Dependabot PRs across apps/api, apps/ui, apps/docs
and the SHA-pinned GitHub Actions into one branch so CI runs once
instead of 23 times.

Lockstep pins the per-PR bumps miss:
- apps/ui overrides for react, react-dom, @types/react, @types/react-dom
  and ws move with their dependency pins (the overrides block documents
  these as must-match).
- apps/docs overrides for @types/react and @types/react-dom mirror the
  UI app's pins for cross-app type parity; no Dependabot PR touches them.
- apps/docs react/react-dom follow the UI app to 19.2.8 so the workspace
  resolves one React.

Excluded: elysia-rate-limit 4.6.2 -> 5.1.0 (#351). It requires
elysia >= 2.0.0 and the API is on elysia 1.4.29, so taking it needs an
Elysia v2 migration rather than a dependency bump. PR left open.

typescript-eslint 8.65.0 tightened @typescript-eslint/unbound-method,
which flagged the window.matchMedia save/restore in theme.utils.test.ts.
Reworked those two suites onto vi.stubGlobal/vi.unstubAllGlobals, the
pattern already used elsewhere in the UI tests. jsdom leaves matchMedia
undefined, so the previous capture-and-restore was restoring undefined
anyway.

Security: osv-scanner blocked the push on advisories that predate this
branch. Refreshed the stale transitive resolutions (brace-expansion,
nanoid) that were already satisfiable inside their existing ranges, and
advanced the override pins that had themselves gone vulnerable —
js-yaml 4.3.1, postcss 8.5.23, undici 7.29.0 in both ui and docs, plus
dompurify 3.4.13 in docs. nanoid needed a quarantine exclusion in both
bunfig.toml files since the patched releases are <7 days old. Dropped
seven allowlist entries the refresh made unnecessary, and added three
for the remaining CI-only exposure with no clean fix: estimo exact-pins
nanoid 5.1.5 and bun rejects scoped overrides, while extract-zip has no
patched release at all.

Consolidating the two vite copies changed Rollup's chunking: four small
feature-constants modules moved into the modulepreload graph, so
.size-limit.json gains a budget covering them. Initial payload is up
~4.6 KB gzip; every existing size budget still passes.

Author: agjs

.github/workflows/apps-api-ci.yml

@@ -79,7 +79,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Detect relevant changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |

.github/workflows/apps-api-openapi-drift.yml

@@ -72,7 +72,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Detect relevant changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |

.github/workflows/apps-api-release.yml

@@ -42,7 +42,7 @@ jobs:
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/apps-api-security-deps.yml

@@ -36,7 +36,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Detect relevant changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |

.github/workflows/apps-api-security-sast.yml

@@ -49,7 +49,7 @@ jobs:
         run: git config --global --add safe.directory '*'
 
       - name: Detect relevant changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |

.github/workflows/apps-api-security-secrets.yml

@@ -40,7 +40,7 @@ jobs:
           fetch-depth: 0
 
       - name: Detect relevant changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |

.github/workflows/apps-docs-linkcheck.yml

@@ -58,7 +58,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Detect docs changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |

.github/workflows/apps-docs-security-deps.yml

@@ -36,7 +36,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Detect relevant changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |

.github/workflows/apps-docs-security-secrets.yml

@@ -40,7 +40,7 @@ jobs:
           fetch-depth: 0
 
       - name: Detect relevant changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |

.github/workflows/apps-ui-bundle-diff.yml

@@ -39,7 +39,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Detect UI bundle changes
-        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+        uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4.0.3
         id: filter
         with:
           filters: |