chore(GAT-9016): sweep the dependency tree and triage Dependabot

[calmacx]

What

Takes npm audit from 45 findings to 21, and from one critical to none. Upgrades react-router and @react-router/* 7.16.0 → 7.18.4, sweeps patch and minor across the tree, takes seven majors, and changes the internal AJV cache key so the fast-uri upgrade is not blocked.

Why

Seventeen Dependabot PRs are open, the oldest from February 2026, all raised against the Express service and a lockfile that has since been rewritten wholesale — #103 already reports CONFLICTING, and #88 names validator and express-validator, neither of which is in the tree at all any more. Rather than merge stale lockfile patches one at a time, this sweeps the tree once and closes them out.

Testing

npm run typecheck, npm run lint and npm run build all exit 0. npm run test:unit 2 passed / 1 file; npm test 58 passed / 9 files against the production build. ?subsection= verified directly on /validate (200), because that is what the fast-uri change protects.

Notes

• The sweep broke subsection validation before it fixed it, and the cause is worth knowing. fast-uri 3.1.6 tightened URI parsing, and AJV resolves schema references through it. The AJV cache key was Name:Version, which parses as a URI with scheme GWDM and path 1.0, so ajv.getSchema("GWDM:1.0#/properties/summary") stopped resolving and both /translate?subsection= and /validate?subsection= returned 400. Bisected across releases: 3.1.5 resolves, 3.1.6 does not. Pinning below 3.1.6 would keep a high advisory in the URI parser that runs on every validate request, so schemaKey() now registers and looks schemas up as Name/Version instead. The key is internal — every string a caller sees (error messages, log lines, translation graph nodes, /list/translations output) still uses Name:Version and is deliberately unchanged. The existing subsection tests are the regression gate; they are what caught it.
• Two majors are blocked upstream, not by anything here. eslint 10 crashes loading react/display-name because eslint-plugin-react 7.37.5 is the newest published and peer-caps at eslint ^9.7. typescript 7 sits outside @react-router/node's peer range of ^5.1.0 || ^6.0.0. Both reverted, both worth revisiting when upstream moves.
• MUI stays on 7 deliberately — @hdruk/ui peer-requires ^7.3.2, so 9.4.0 is not an upgrade this service can take.
• @semantic-release/npm is dropped from devDependencies: release.config.js never loads it and the package is private: true so it could not publish anyway. This does not shrink the tree — semantic-release depends on it directly, so the npm CLI and its transitive advisories stay. Measured before and after: no change to the audit count.
• npx semantic-release --dry-run fails on this branch, with ERR_REQUIRE_CYCLE_MODULE loading release.config.js. It fails identically on the base branch, so this PR did not cause it and does not address it — flagged only so a reviewer does not attribute it to the upgrades.
• Of the 21 findings left, 15 are in the build and release toolchain rather than anything the service loads at runtime.
• Stacked on feat(GAT-9016): adopt @hdruk/ui and downgrade MUI to v7 #146.

[gh-actions-pipelines-app]

🎉 Great job! Your PR title follows the correct format. 🚀

[calmacx]

Closing without merging per the 2026-09-24 workstream restructure — this dependency sweep is redone from scratch as WS7 once WS4–WS6 land and dev has absorbed their new packages. See upgrade-plans/02-tracker.md and upgrade-plans/ws7-pr01-final-dependency-review.md.