Third-row medals, an award constants refactor, and a repaired sprite generator

This release rewrites medal placement in the uniform builder so a third row works, moves the award and MOS string literals into a constants module, and repairs the award sprite generator that the refactor had quietly broken.

Uniform builder

• Third-row medal placement, rewritten (#189, thanks @Vercin-G). A third row was never really intended, and the code that half-handled it could not be adjusted without untangling it first. That section is rewritten so a third row lays out correctly, and it now errors if anything larger is attempted. Fixes #179.
• Badge logic restored and rewritten (#176, thanks @Vercin-G). The badge changes did not carry over through the refactor. Combat badge selection was also rewritten to be readable, and the aviator badge awardPriority values were corrected.
• Award and MOS constants, and a data-driven registry (#130, thanks @JensGryspeert). Award types, ribbon attachment types and MOS codes move into a single constants/ module, and AwardRegistry builds its Map by looping over AWARD_CATALOG instead of ~100 imperative set() calls. Adding an award is now a one-line entry. No behavior change.

Award sprite generator

The generator deletes the contributor's source PNGs and empties manifest.json when it succeeds, so a run that does only part of the work and still exits 0 is worse than a crash. Three bugs of that shape are fixed here.

• Repaired after #130 (#177). The generator read each award's placement by matching AwardRegistry.jsx as text. #130 moved that data into awardCatalog.js, the matcher stopped finding anything, and every upload failed. The two PRs touched disjoint files, so the merge was clean and nothing flagged it. It reads the catalog now, and a test covers it.
• Two silent failures now fail loudly (#178). A placement field left out of the catalog with art supplied anyway, and a repeated priority. Both used to warn and carry on, consuming the source art and emptying the manifest on the way out.
• Sheets reconciled against the catalog (#180). A forgotten replace key inserted a tile onto a row that already had one, pushing every award below it down a row on both sheets. Against the real 105-award catalog that shifted 67 ribbons and 44 medals into their neighbour's art, with no diagnostics and exit code 0. The medal sheet's stray transparent row is cropped as well.

Dependencies and CI

• Server: node-pg-migrate 9.0.0, mysql2 3.23.0, body-parser 2.3.0, brace-expansion 5.0.7 (#175, #181, #185, #186)
• Client: next 16.2.11, sharp 0.35.0 (plus an override for the transitive copy), and three rounds of minor-patch bumps (#169, #174, #182, #183, #184, #188)
• CI: actions/setup-node 7 (#173, #187)

Full changelog: 1.4.0...1.5.0