chore(deps): npm audit fix — react-router CSRF + babel/form-data/js-yaml

After the vite 5→8 bump, `npm audit` surfaced 5 advisories (1 high). All
have semver-compatible fixes, applied via `npm audit fix` (lockfile only,
no package.json range changes, no breaking bumps):
  * react-router / react-router-dom 7.15.0 → 7.18.0 — CSRF via
    PUT/PATCH/DELETE document requests (GHSA-84g9-w2xq-vcv6)
  * @babel/core — arbitrary file read via sourceMappingURL (build-time)
  * form-data — CRLF injection (transitive, dev/test)
  * js-yaml — quadratic-complexity DoS in merge keys (transitive)

npm audit now reports 0 vulnerabilities. Build + 25 frontend tests green.

Author: DaveBugg