Consolidate dependency major upgrades

[ajccarlson]

Consolidates the compatible majors from the ten open Dependabot PRs into one validated upgrade, following the usual consolidation workflow.

Upgraded (closes #81, #84, #87, #88, #89, #90)

• execa 8 → 10 — replaced the removed execaCommand with an argv execa call in the Vitest global setup.
• helmet 7 → 8 — no code changes needed; CSP config is fully explicit in server/index.ts.
• @paralleldrive/cuid2 2 → 3, @faker-js/faker 8 → 10 (userName() → username()) — mechanical.
• remix-utils 8 → 10 — no API breaks in our usage (honeypot, toast, client hints).
• @epic-web/totp 1 → 4 — the API is now async and uses Web Crypto, which only accepts dashed algorithm names. New verifications generate SHA-256; stored SHA256 rows are normalized at verification time so already-enrolled 2FA users keep working. getTOTPAuthUri strips dashes itself, so authenticator-app URIs are unchanged.

Deferred

• eslint/@eslint/js 10 (deps-dev(deps-dev): bump @eslint/js from 9.39.5 to 10.0.1 #85, deps-dev(deps-dev): bump eslint from 9.39.5 to 10.7.0 #86) — eslint-plugin-react 7.37.5 caps its peer range at ESLint ^9.7 and crashes under 10 (getFilename removal). Revisit when the plugin ships v10 support.
• prisma/@prisma/client 7 (deps(deps): bump @prisma/client from 6.19.3 to 7.9.0 #82, deps(deps): bump prisma from 6.19.3 to 7.9.0 #83) — Prisma 7 removes url from schema datasources and requires driver adapters in every PrismaClient constructor. With our dual SQLite/PostgreSQL runtime and env-injected test databases, this needs a dedicated migration branch.

Validation

validate:release:static, validate:release:unit (full coverage run), production build, and targeted Playwright suites (2fa, onboarding, settings-profile, accessibility — 29 tests) all pass.