Clean up post-#28 quality failures (lint-check, Vue eslint/stylelint, npm Security/License)

[rubenvdlinde]

PR #28 (CnAppRoot Tier-4 shell) was admin-merged with 5 failing quality checks per pre-production rules + org-budget constraints. The substantive work (manifest.json, CnAppRoot mount, 6 ADR-031 PHP exceptions, validate-manifest test) is all in. The failures are quality hygiene:

1. lint-check — likely package-lock.json out of sync with new @conduction/nextcloud-vue dep
2. quality / Vue Quality (eslint)
3. quality / Vue Quality (stylelint)
4. quality / Security (npm) — npm-audit vulnerability in transitive deps
5. quality / License (npm) — license-checker incompatibility with newly added transitive dep

Acceptance

• All 5 quality checks green on development
• No functional change to the shell

Context

PR #28: #28
Architect verdict on shell design: APPROVE WITH DEFERRED-QUESTIONS (PR #20 review)

[rubenvdlinde]

Done in PR #44 (test+chore): package-lock.json resynced, ESLint clean, Stylelint clean (also fixed the CohortTimetable.vue errors in PR #50), npm-audit (--audit-level=critical --omit=dev) exits 0, license-checker green. All five quality checks pass on development. Closing.