Harden dependencies and streamline analytics

[PengfanZ]

What changed

• pin Supabase Edge Function imports and override vulnerable transitive npm dependencies
• count a confirmed AI expense batch as one atomic expense_added analytics action instead of one request per generated expense
• import ModalShell directly from its owning module
• update security, analytics, README, and AI operations documentation to match the current production architecture

Why

The cleanup audit found dependency advisories, branch-specific documentation left over from the AI preview, and analytics fan-out that could create unnecessary requests for large generated batches. These changes reduce supply-chain drift and align code and documentation with the product's current behavior without altering expense or Live synchronization semantics.

Validation

• npm audit --json - 0 vulnerabilities
• npm run typecheck
• npm run lint
• npm run test:coverage - 56 files, 489 tests, 100% statements/branches/functions/lines
• npm run build:pages
• npm run test:backend - 153 pgTAP tests
• npm exec supabase -- db lint --local --level warning --fail-on none
• npm run test:e2e - 12 stable + 14 AI Playwright journeys
• desktop and 390x844 mobile production-build smoke test with no app console warnings/errors

The existing vite-plugin-pwa 1.3.0 build-time deprecation warning remains upstream and does not affect the generated service worker or test results.