fix(deps): resolve all frontend npm audit vulnerabilities

[ynixt]

Clears 31 findings (2 critical, 22 high, 4 moderate, 3 low) reported by Dependabot on frontend/package-lock.json, bringing npm audit to zero.

npm audit fix could not resolve the Angular packages: they peer-pin each other at an exact version, and incremental updates kept failing with ERESOLVE against the stale tree. Regenerating package-lock.json resolved everything within the existing package.json ranges, so no dependency ranges needed loosening.

Notable bumps:
@angular/{core,common,compiler,forms,router,...} 21.2.7 -> 21.2.20
@angular/build 21.2.6 -> 21.2.21
vite 7.3.1 -> 7.3.6
vitest 4.0.18 -> 4.1.10
postcss 8.5.10 -> 8.5.26
immutable 5.1.5 -> 5.1.9
piscina 5.1.4 -> 5.2.0
undici 7.24.4 -> 7.29.0
js-yaml 4.1.1 -> 4.3.1
fast-uri 3.1.2 -> 3.1.5
ip-address 10.2.0 -> 10.5.0
tar 7.5.13 -> 7.5.22
brace-expansion, ws, nanoid, hono, sigstore, qs, esbuild patched

Duplicate nested copies of vite, esbuild and @angular/build under @angular-builders/custom-esbuild are now deduped.

Also pins eslint to ^9.39.1 in devDependencies. It was never declared and only arrived transitively via the eslint plugins, which happened to hold it at 9.39.1. On regeneration it floated to 10.8.1, which drops the bundled @eslint/eslintrc and broke npm run lint outright. Migrating to ESLint 10 is a separate change, not part of a security patch.

Verified: build succeeds, 158 tests across 43 files pass, eslint and prettier clean.