Update frontend dependencies

[kaysond]

Closes #937

Refreshes the frontend dependency tree so the open dependabot PRs can be closed, and drops the
packages that were pulling in vulnerabilities without being used. No UI changes.

What changed

Removed unused packages (each verified to have no reachable usage in src/):

Package	Why it can go
crypto-js, @types/crypto-js	zero references anywhere in src/ or e2e/
rrule	zero references
ngx-markdown	only MarkdownModule.forRoot({}) in app.module.ts; no <markdown> element, directive, component or service is used anywhere. Pulled in marked, prismjs and katex.
quill	no JS/TS import at all — only quill.snow.css in vendors.scss and a .ql-* override sheet. Nothing in the app renders .ql-* markup.
tslint, codelyzer, tslint.json, the lint target	angular.json pointed at @angular-devkit/build-angular:tslint, a builder that no longer exists in the installed @angular-devkit/build-angular@13.3.11, so npm run lint was already failing.
protractor, jasmine-spec-reporter, @types/jasminewd2, e2e/, the e2e target	Protractor is EOL and nothing runs the e2e target (not in CI, not in the Makefile). It was the source of request, form-data@2.3.3, webdriver-manager, adm-zip, xml2js and tough-cookie.
@types/highlight.js	deprecated stub; highlight.js has shipped its own types since v10

Bumped every remaining direct dependency to the newest release that still works on this
toolchain, and fixed three ranges that were already unsatisfiable — on master a plain
npm install (as opposed to npm ci) resolves them to versions that cannot build:

Package	Was	Resolved to	Broke because	Now
@types/lodash	^4.14.188	4.17.x	infer N extends number needs TypeScript ≥ 4.7	~4.14.202
@types/node	^18.11.9	18.19.130	18.19.48+ uses typeof ServerResponse<…> generics, needs TypeScript ≥ 4.7	18.19.47
ng-apexcharts	^1.7.4	1.8.0	ships an Angular 14+ ɵɵComponentDeclaration (8 type args; Angular 13 wants 6)	~1.7.7

The @types/node one is the nastiest of the three: it only breaks the spec build, so ng test
serves a 404 for /_karma_webpack_/main.js and prints Executed 0 of 0 SUCCESS / TOTAL: 0 SUCCESS.
The exit code is non-zero, but the human-readable output says SUCCESS.

Added an overrides block for the transitive packages that had advisories but no direct
dependency to bump.

Result

Advisories against the lockfile go from 134 across 57 packages to 24 across 6:

	before	after
critical	5	0
high	59	12
moderate	56	10
low	14	2

The production bundle also gets smaller — initial total 325.88 kB → 293.80 kB transferred
(main 207.68 → 191.61 kB from dropping ngx-markdown, styles 89.21 → 86.79 kB from dropping
quill, polyfills 27.63 → 13.98 kB because the refreshed caniuse-lite narrows the browserslist
result).

One thing worth eyeballing: apexcharts moves 3.37.3 → 3.54.1 (within the peer range
ng-apexcharts already declared). It is the only runtime library in this PR that draws anything, so
it is the only one that could plausibly shift rendering.

What is deliberately not fixed

@angular/core, @angular/common and @angular/compiler still carry advisories; every fix for
them lands in Angular ≥ 18.2.15 / ≥ 19.2.26. Dependabot's proposal (#859, #981) is to jump to
v21-lts, which cannot be done without UI changes:

src/@treo/styles/treo.scss, src/@treo/styles/vendors/_angular-material.scss and
src/@treo/styles/utilities/_colors.scss are built on the legacy Angular Material Sass API
(@import '~@angular/material/theming', mat-core(), mat-light-theme($p, $a, $w)). That API was
removed in Angular Material 15 — the same release that moved every component to MDC, which changes
component metrics and appearance and orphans the .mat-form-field-* overrides in
src/@treo/styles/overrides/_angular-material.scss. Doing that upgrade properly means rewriting the
Treo theming layer, so it wants to be its own issue rather than part of a dependency refresh.

The rest of the remainder is dev-only and unfixable on this toolchain:

• webpack-dev-server@4.7.3 — no fix exists in the 4.x line, and 5.x is not compatible with the
  Angular 13 dev-server builder. Only reachable via ng serve.
• ip — no fixed version has been published for GHSA-2p57-rm9w-gvfp.
• brace-expansion — the fix is 5.0.8, which is ESM-only and would break minimatch's require().

AI disclosure

Per AI_POLICY.md: this branch was written by Claude Code (Opus 5). It made all of
the code and config changes above, chose the override set, and ran the checks below. Everything ran
inside containers (node:24-trixie with headless Chromium); nothing was installed on the host.

Automated verification performed, on this branch and against master for comparison:

• npm ci and npm install — both clean
• npm run build:prod — succeeds; the bundle sizes above are measured, not estimated
• npx ng test --watch=false --browsers=ChromeHeadless --code-coverage — 87/87 pass, same as master
• pacote.extract() exercised end to end, to confirm the tar major-version override does not break
  @angular/cli's package fetching (ng add / ng update)
• advisory counts re-queried from the npm bulk advisory endpoint after every change

That is the extent of the verification behind this PR as opened; no manual/browser testing is claimed.