fix security vulns by updating:
- Node.js to 24.22.1
- DOMPurify to 3.4.17
- proxy-addr to 2.0.8
- ip-address to 10.7.4
- follow-redirects to 1.16.1
- source-map-js to 1.2.2
- Vite to 6.4.5 for documentation, 7.3.7 for the frontend, and 8.3.5 for backend tests
- Vitest to 4.1.12
- TypeScript ESLint to 8.72.0 in the frontend
- Sass to 1.106.1
- KaTeX to 0.18.10
- postcss-selector-parser to 7.1.7
- Alpine runtime packages
- backend runtime tooling to remove bundled npm, npx, and Yarn