Catalog and override inconsistencies in pnpm-workspace.yaml and knip.jsonc

[dex4er]

Goal

Fix three small configuration inconsistencies found during the dependency audit in #2360.
None of them is urgent; together they make the catalog mean what its comment says it
means.

Current state

1. overrides silently beats the catalog

pnpm-workspace.yaml pins mobx-react: 9.1.1 in the catalog, whose header comment reads
"Versions here are pinned exactly … the pinned version is what the app is built and tested
against". But the root overrides block also carries mobx-react: ^9.1.1, and overrides
outrank catalog entries, so the lockfile resolves 9.2.2:

rg -n 'mobx-react@9\.2\.2' pnpm-lock.yaml | head -1

We are therefore not building against the pinned version, and the contract stated at the
top of the file does not hold.

@ogre-tools/injectable-react@23.2.0 peers mobx-react: ^9.1.1, which our catalog pin
already satisfies. Both the override and
peerDependencyRules.allowedVersions.mobx-react: '9' are leftovers from the mobx-react
7 to 9 migration and should no longer be needed.

2. Stale knip entry

knip.jsonc:126 still lists @types/react-window under
workspaces["packages/extensions"].ignoreDependencies. The package was dropped in #2283
(react-window v2 ships its own types) and appears nowhere else in the repo.

3. mobx-react-lite duplicates mobx-react

mobx-react-lite is a separate direct dependency imported by 13 files, all of them only
for observer, which mobx-react 9 re-exports.

Tasks

• Remove the mobx-react entry from overrides and the mobx-react entry from
  peerDependencyRules.allowedVersions; confirm the lockfile then resolves the pinned
  9.1.1 and that pnpm install reports no unmet peers.
• Remove the stale @types/react-window entry from knip.jsonc and confirm
  pnpm knip:check stays green.
• Consolidate the 13 mobx-react-lite imports onto mobx-react and drop
  mobx-react-lite from packages/core and the catalog.

Risk notes

• Moving from mobx-react 9.2.2 back to the pinned 9.1.1 is a downgrade in practice; run
  the unit suite and a live smoke test rather than assuming the pin is inert.
• The mobx-react-lite consolidation touches observer-wrapped metrics components; watch
  for snapshot churn.

Split out of #2360.