chore: complete runtime and dependency upgrades

[Che-Zhu]

Summary

• apply the security dependency updates first and restore both full and production-only npm audits to zero
• adopt Node.js 24.18.0 and its bundled npm 11 across package engines, CI, Docker, Vercel guidance, and contributor documentation
• migrate Prisma 6 to the Rust-free Prisma 7 client with the PostgreSQL driver adapter and explicit generated-client output
• refresh compatible frontend and test toolchain patch/minor versions while deferring TypeScript 7 and ESLint 10
• add conservative Dependabot grouping, CI vulnerability review, and a documented dependency-maintenance policy

Each coherent upgrade batch remains an independent commit.

Important behavior

• no .nvmrc, .node-version, or devEngines was added
• zero-configuration public builds and Docker startup remain supported when Auth and database variables are absent
• Prisma Client is initialized lazily, preserving that zero-configuration path
• Dependabot does not auto-merge and does not manage Docker runtime versions independently
• repository-level Dependabot security updates should be enabled after this configuration reaches main

Validation

• Node.js 24.18.0 / npm 11.16.0
• npm ci
• npm run audit:prod — 0 vulnerabilities
• npm run audit — 0 vulnerabilities
• npm run lint
• npm test — 8 files, 40 tests passed
• npm run prisma:validate
• baseline migration against PostgreSQL 16
• npm run test:e2e — 18 tests passed across desktop, mobile, and narrow viewports
• zero-configuration npm run build
• Docker image build and startup smoke test
• Docker HTTP checks: / 200, /login 200, zero-config /api/auth/session 503

Closes #183