fix(ci): revert unverified npm tooling update

[erseco]

Summary

Revert the grouped npm tooling update merged in #73:

• @biomejs/biome 2.5.2 → 2.5.0
• @types/node 26.1.0 → 26.0.0
• webpack 5.108.4 → 5.107.2

Both package.json and package-lock.json are restored to the last dependency state that completed the main CI workflow successfully.

Root cause

PR #73 was merged without a CI workflow run being associated with its head commit. Only the Playground preview workflow ran successfully. This means the grouped dependency update reached main without the frontend and Nextcloud/PHP matrix checks that had run successfully on previous PRs.

There is not enough CI log evidence to attribute the problem to one of the three packages individually, so this hotfix deliberately avoids guessing and rolls back the complete unverified group.

Impact

This returns main to the last CI-validated npm dependency set while keeping all unrelated changes, including the documentation update from #71.

Validation

• The hotfix contains one commit on top of the current main commit.
• Only package.json and package-lock.json are changed.
• The restored files match commit 22e2b669367236d1eaf12214d378e91a873593bb, before build(deps-dev): bump the npm-tooling group with 3 updates #73.
• GitHub Actions on this PR should confirm whether the CI workflow is running normally again.

Refs #73

[github-actions]

Preview this PR in the Nextcloud Playground

A fresh Nextcloud boots in your browser with this branch's exelearning app installed and enabled (log in as admin / admin). Two sample .elpx are seeded under exelearning-samples/ in Files — click one to open the viewer.

eXeLearning editor: v4.0.2 (overlaid at boot from the upstream release).

[erseco]

Closing in favor of #76. The rollback confirmed that the previous dependency state passed CI, but a diagnostic run against the #73 dependency state identified the focused root cause: webpack 5.108.4 no longer installs terser-webpack-plugin transitively, while @nextcloud/webpack-vue-config@7.0.2 imports it directly. PR #76 declares that dependency explicitly and keeps the unrelated updates.