fix(deps): resolve 54 of 80 Dependabot security alerts (safe batch)

[nwittwer]

Summary

Resolves 54 of 80 open Dependabot security alerts with safe, non-breaking dependency updates against dev. All criticals/highs in the shipped Electron runtime (crypto, networking, archive, parsing libs) are fixed.

✅ Verified locally: yarn install, app unit tests (7/7), and nuxt generate all pass.

What changed

Direct in-major bumps (manifests):

package	from	to
@trpc/client + @trpc/server	^10.4.3	^10.45.3
systeminformation	^5.21.7	^5.31.6
postcss (app + packages/ui)	^8.4.31	^8.5.10
@babel/core (packages/ui)	^7.14.8	^7.29.6

Transitive fixes: yarn dedupe + re-resolution to patched latest-in-range, plus targeted root resolutions for single-major packages (axios 0.32.0, on-headers 1.1.0, trim 0.0.3). Clears form-data, elliptic, pbkdf2, sha.js, shell-quote, handlebars, simple-git, tar (7.x), ws, undici, braces (3.x), cross-spawn (7.x), semver (7.x), minimatch (9.x), node-forge, glob, rollup (4.x), and more.

Build/CI fixes uncovered while validating:

• CI: Node 16 → 22. Node 16 is EOL (Sept 2023); the runner crashed in nuxt prepare. Bumped the build matrix.
• @vitejs/plugin-vue declared explicitly in app. app/vitest.config.ts imported it but relied on hoisting from packages/ui; after dedupe it was no longer resolvable, breaking the test step. Pinned ^4.6.2 (matches vitest 0.31's bundled vite 4).
• nuxt held at 3.12.4 (pinned exact). Floating into the 3.13+ line pulls vite 5→7, which cascades into breaking build changes. Deferred to a dedicated nuxt/vite/vitest upgrade.

Not included — needs dedicated follow-up

Breaking major upgrades that require code/build changes + testing:

• Shipped app: electron 23→39, electron-updater 5→6, uuid 8→11, vitest 0→3
• nuxt/vite stack: nuxt 3.12→3.21, vite 2/4/5→6/7 (cascades into Node already done, Sass modern API, electron externalization)
• Dev-only tooling, not shipped (packages/ui Storybook 6 / webpack4 chain, @octokit release tooling, electron-builder 23→24): braces 2.x, micromatch 3.x, rollup 2.x, serialize-javascript, webpack-dev-middleware 3.x, trim-newlines, @tootallnate/once
• ip — no patched version published upstream

Note on yarn berry

Scoped resolution keys (pkg@npm:^6.0.0) are ignored by yarn 3.6; bare resolutions force all major lines (would break cross-major peers like js-yaml safeLoad, webpack4, ajv-keywords). Bare resolutions here are limited to single-major packages.

Supersedes

Closes stale Dependabot PRs: #281, #282, #283, #287, #288, #289, #290, #291, #293, #294. (#278 electron-updater and #292 vite are major bumps deferred to the dedicated upgrade.)

🤖 Generated with Claude Code

[nwittwer]

Build pipeline fixed end-to-end

Investigated the remaining CI failure. After the install/test fixes, the build reached the electron-builder step and hung ~25min. Root cause: nuxt generate completes its work but never exits — nuxt-electron's vite build leaves an fsevents file-watcher open, so the && electron-builder step in yarn build never starts.

This is pre-existing on dev — I reproduced the identical hang on a clean origin/dev checkout, so it's independent of the dependency bumps (it was previously masked by the Node 16 install crash that aborted CI earlier).

Fixed with a Nuxt close hook that exits once Nuxt closes after a non-dev build. Verified locally — yarn build now runs generate → electron-builder end-to-end (exit 0), producing signed-skipped .dmg/.zip for both arm64 and x64.

So this PR now also unbreaks the build, not just the security alerts.