chore(deps): TanStack SSR packages and jest-dom 7

[ByteMeBaby]

Picks up two of the three updates held back from #52. Supersedes #53 and #54. The third, jsdom 30 (#55), is blocked on the local Node version and is explained at the bottom.

What this changes

b804f2b TanStack router and start. @tanstack/react-router 1.170.18, @tanstack/react-start 1.168.34. These were held back from #52 because they drive SSR and no gate executes the server bundle, so they needed a manual render check rather than a green test run. Taking both to latest also collapses @tanstack/router-core, which the lockfile carried at 1.171.14 and 1.171.15 simultaneously, down to a single 1.171.15. That is why the commit removes more lockfile lines than it adds.

b783bc7 @testing-library/jest-dom 7. The one breaking change in v7 is that @testing-library/dom becomes a required peer, with the Node floor raised to 22. apps/web imports @testing-library/jest-dom/vitest in its test setup but never declared @testing-library/dom, relying on @testing-library/react to drag it in, so this adds the explicit declaration alongside the bump. packages/ui already declared it. Dependabot's #54 bumped the version without adding the peer.

Nothing else in v7 touches this repo. The matchers in use are toBeInTheDocument, toHaveAttribute, toHaveTextContent, toHaveClass, toContainElement, and toBeDisabled, all stable core matchers.

Verification

• Both commits pass pnpm install --frozen-lockfile individually, so neither carries a lockfile out of sync with its manifests.
• All four gates pass uncached under TURBO_FORCE=true, pnpm test:e2e passes, pnpm audit reports no known vulnerabilities.
• apps/web/src/routeTree.gen.ts does not drift after tsr generate.
• pnpm install reports no unmet peers after the jest-dom bump.
• The 18 component tests in packages/ui that actually exercise the jest-dom matchers pass.
• SSR render check for the TanStack bump, which no gate covers: the dev server returns 200 and the rendered HTML differs from the pre-bump render only by a per-render match id.

Not included: jsdom 30 (#55)

jsdom@30.0.1 declares engines: ^22.22.2 || ^24.15.0 || >=26.0.0. The local Node is v24.8.0, which satisfies none of those ranges, since ^24.15.0 means >=24.15.0 <25.0.0. Bumping Node to 24.15 or later would unblock it. There is no engines field or .nvmrc in the repo pinning a version, so this is a local toolchain decision rather than a repo constraint.

Also still outstanding: typescript 7.0.2. Dependabot has not proposed it, and correctly so. typescript-eslint@8.65.0 declares a peer of typescript: >=4.8.4 <6.1.0, so TypeScript 7 is not installable until typescript-eslint widens that range.