chore(deps): upgrade all dependencies to latest and pin exact

Policy: every direct dependency is now an exact pin; lockfile + --frozen-lockfile keep builds reproducible; save-exact=true enforced.

Toolchain:
- pnpm 10.26 -> 11.18 (lockfile migrated; supportedArchitectures moved to pnpm-workspace.yaml)
- typescript 5.9 -> 7.0, vite 7 -> 8, @vitejs/plugin-react 5 -> 6
- esbuild override 0.27.3 -> 0.28.1 (closes GHSA-g7r4-m6w7-qqqr); added @esbuild/darwin-arm64 for local dev
- orval 8.9 -> 8.23, regenerated clients

Backend (prod image):
- openid-client 5.7 -> 6.8 (rewritten OIDC flow in routes/auth.ts: discovery + functional API, PKCE/state, fetchUserInfo, buildEndSessionUrl)
- pino 9 -> 10, pino-http 10 -> 11, thread-stream 3 -> 4
- zod 3.25 -> 4.4 (catalog; supported by drizzle-zod 0.8.3)
- pg 8.20 -> 8.22; removed deprecated @types/bcryptjs

Frontend:
- react/react-dom 19.1.0 -> 19.2.8 (catalog pin lifted; expo note removed)
- react-day-picker 9 -> 10 (table classname -> month_grid)
- recharts 2 -> 3 (TooltipContentProps + DefaultLegendContentProps typing; safe keys)
- react-resizable-panels 2 -> 4 (Group/Separator rename)
- date-fns 3 -> 4, @hookform/resolvers 3 -> 5, lucide-react 0.545 -> 1.28
- all @radix-ui/*, tailwind, types, and remaining patch/minor deps bumped to latest

Security/process:
- overrides for body-parser >=2.3.0 (GHSA-v422-hmwv-36x6) + markdown-it/linkify-it/brace-expansion/fast-uri (dev tooling)
- pnpm audit now reports 0 vulnerabilities (prod and full)
- CI audit gate added to build.yaml; docs/dependency-policy.md; renovate.json
- Dockerfile pins node:24.18.1-alpine and pnpm@11.18.0

pnpm-workspace.yaml

@@ -27,6 +27,14 @@
 # ============================================================================
 minimumReleaseAge: 1440
 
+supportedArchitectures:
+  os:
+    - current
+    - linux
+  cpu:
+    - current
+    - x64
+
 minimumReleaseAgeExclude:
   # Exclude @replit scoped packages from the minimum release age check.
   # These are published by Replit and trusted — the supply-chain attack vector
@@ -41,31 +49,29 @@ packages:
   - scripts
 
 catalog:
-  '@replit/vite-plugin-cartographer': ^0.5.1
-  '@replit/vite-plugin-dev-banner': ^0.1.1
-  '@replit/vite-plugin-runtime-error-modal': ^0.0.6
-  '@tailwindcss/vite': ^4.1.14
-  '@tanstack/react-query': ^5.90.21
-  '@tanstack/react-virtual': ^3.13.6
-  '@types/node': ^25.3.3
-  '@types/react': ^19.2.0
-  '@types/react-dom': ^19.2.0
-  '@vitejs/plugin-react': ^5.0.4
-  class-variance-authority: ^0.7.1
-  clsx: ^2.1.1
-  drizzle-orm: ^0.45.2
-  framer-motion: ^12.23.24
-  lucide-react: ^0.545.0
-  # Must be this exact version because expo requires it
-  react: 19.1.0
-  # Must be this exact version because expo requires it
-  react-dom: 19.1.0
-  tailwind-merge: ^3.3.1
-  tailwindcss: ^4.1.14
-  tsx: ^4.21.0
-  vite: ^7.3.4
-  wouter: ^3.3.5
-  zod: ^3.25.76
+  '@replit/vite-plugin-cartographer': 0.6.1
+  '@replit/vite-plugin-dev-banner': 0.1.2
+  '@replit/vite-plugin-runtime-error-modal': 0.0.6
+  '@tailwindcss/vite': 4.3.3
+  '@tanstack/react-query': 5.101.4
+  '@tanstack/react-virtual': 3.14.9
+  '@types/node': 26.1.2
+  '@types/react': 19.2.18
+  '@types/react-dom': 19.2.4
+  '@vitejs/plugin-react': 6.0.5
+  class-variance-authority: 0.7.1
+  clsx: 2.1.1
+  drizzle-orm: 0.45.2
+  framer-motion: 12.43.0
+  lucide-react: 1.28.0
+  react: 19.2.8
+  react-dom: 19.2.8
+  tailwind-merge: 3.6.0
+  tailwindcss: 4.3.3
+  tsx: 4.23.1
+  vite: 8.2.0
+  wouter: 3.10.0
+  zod: 4.4.3
 
 autoInstallPeers: false
 
@@ -157,7 +163,17 @@ overrides:
   "@expo/ngrok-bin>@expo/ngrok-bin-win32-ia32": "-"
   "@expo/ngrok-bin>@expo/ngrok-bin-win32-x64": "-"
   # drizzle-kit uses esbuild internally on an older version that's vulnerable, this overrides it
-  "@esbuild-kit/esm-loader": "npm:tsx@^4.21.0"
-  esbuild: "0.27.3"
+  "@esbuild-kit/esm-loader": "npm:tsx@4.23.1"
+  esbuild: "0.28.1"
   # Fix GHSA-q8mj-m7cp-5q26: qs DoS via stringify with null/undefined in comma-format arrays
-  qs: ">=6.15.2"
+  qs: ">=6.15.2"
+  # Fix GHSA-v422-hmwv-36x6: body-parser DoS via invalid limit value (express dep)
+  body-parser: ">=2.3.0"
+  # Build-time tooling (orval/typedoc) advisories: force patched versions
+  markdown-it: ">=14.1.2"
+  linkify-it: ">=5.0.2"
+  brace-expansion: ">=5.0.8"
+  fast-uri: ">=3.1.4"
+
+allowBuilds:
+  esbuild: set this to true or false