[NDCCCCCC]

Context

PR #26 (dependabot dev-deps bump) failed at the lint step 8 minutes into the CI pipeline with a confusing error:

Error: typescript-eslint does not support TS 7.0.

The root cause was the upstream peer cap typescript: ">=4.8.4 <6.1.0" — but the message only surfaced after lint was already running. By that point CI had wasted ~8 minutes on npm ci + format check, and the message didn't tell the maintainer which package had the incompatible peer.

PR #27 (this branch's predecessor) pinned toolchain majors in dependabot.yml, but the fix is reactive (locks majors we already hit). For future toolchain bumps — eslint 10, vite 8, vitest 5, typescript-eslint v9, react 20, @types/* — we want a CI safety net that catches peer incompatibilities at the cheap npm ci step instead of at the lint step.

What this PR does

1. CI peer-compat pre-flight check (.github/workflows/ci.yml)

New step Peer dependency compat check inserted right after npm ci, before the slow Format check / Lint / Type check / Test / Build pipeline.

Runs npm ls --all --json, parses the problems array, fails fast if any peer violation exists. Output is plain English listing each conflicting peer (e.g. typescript@7.0.2 invalid: ">=4.8.4 <6.1.0" from typescript-eslint@8.70.0).

Cost: ~10 seconds. Saves: up to ~9 minutes of pipeline + much clearer error message.

2. Extend .github/dependabot.yml ignore coverage

PR #27 already locked:

• typescript >= 7
• typescript-eslint >= 9
• eslint >= 10
• vite >= 8
• vitest / @vitest/* >= 5
• @vitejs/plugin-react >= 6
• jsdom >= 28
• @testing-library/jest-dom >= 7

This PR adds 4 more cross-cutting majors that would create the same failure shape (peer-incompatible major bump hitting CI without warning):

production:

• @types/node >=26 (must move with typescript major)
• @types/react >=20 (must move with typescript major)
• @types/react-dom >=20 (must move with typescript major)
• react >=20 (peer of antd 6 + react-query 5, may break)
• react-dom >=20 (peer of antd 6 + react-query 5, may break)

development:

• @types/node >=26
• @types/react >=20
• @types/react-dom >=20

Comments explain which majors are coupled so the v1.35 toolchain phase knows to unlock them together.

Verification

Local test of the pre-flight check:

npm ci --legacy-peer-deps  # current main, lockfile clean
npm ls --all --json | jq '.problems'   # should be []

When a toolchain major is dropped in (e.g. typescript 7 in a local branch), the step should fail with peer violations surfaced directly.

Followup

• v1.35 toolchain phase: once typescript-eslint v9 ships with TS 7 support (#10940), unlock all ignores and run a coordinated major bump across typescript + @types/* + typescript-eslint + eslint + vite + vitest + @vitest/* + @vitejs/plugin-react + jsdom.
• Long-term: consider a dependency-audit.yml workflow on weekly schedule that runs npm ls --all against current main and posts a summary issue if peer drift appears.