[P1-2] Replace abandoned DotNetCore.NPOI with official NPOI 2.7.6

[cct08311github]

DotNetCore.NPOI 1.2.3 is abandoned fork with no security patches. Official NPOI actively maintained at 2.7.x. API compatible, same namespaces. Risk: Medium | Effort: 1-2 days

[cct08311github]

Fixed in commit 3036112c (fix(deps): replace DotNetCore.NPOI 1.2.3 with NPOI 2.7.6 [P1-2]).

Additional NPOI 2.7.6 API compatibility fixes:

• d2f527a5: GetRowEnumerator() → GetEnumerator()
• 03bab0c1: AddMergedRegion single-cell guard
• 875563c5: SetSheetHidden → SetSheetVisibility

CI: ✅ passing