Repair the Townlight Records frontend dependency gate

[scottconverse]

What

Repairs the Townlight Records frontend dependency gate with a deliberately narrow package update:

• updates react-router-dom from 7.18.1 to 7.18.2
• refreshes the lock to patched non-major releases for affected transitive packages
• removes all currently reported npm vulnerabilities at the configured gate

Why

The existing Records release gate failed on seven high-severity npm advisories. A public beta candidate cannot start from a known-red dependency lock.

Verification

• npm audit --audit-level=moderate: 0 vulnerabilities
• Vitest: 42 passed
• Playwright: 2 passed
• frontend build: PASS
• API type generation: PASS with no tracked generated diff
• repository policy suite: ALL CHECKS PASSED
• diff check: PASS

Scope and limits

This is frontend-only. Docker was unavailable locally, so backend container verification is left to CI. It does not rename technical package IDs, replace unsafe demo data, consolidate the desktop and Python execution paths, or declare the product beta-ready.