Upgrade dependencies across the workspace

[kmcginnes]

Description

Routine dependency maintenance bringing the workspace up to latest mature versions. Dependency-only change — only package.json (root + 3 packages) and pnpm-lock.yaml are touched; no source code changes.

Two logical parts (one commit each):

1. Minor/patch bumps (~35 across all packages) — React 19.2.5→19.2.7, Vite 8.0.9→8.0.16, Vitest 4.1.5→4.1.8 (lockstep across all packages), Tailwind 4.2.4→4.3.0, Zod 4.3.6→4.4.3, jotai 2.19.1→2.20.0, radix-ui 1.4.3→1.5.0, react-router 7.16→7.17, react-hook-form 7.73→7.78, @aws-sdk/credential-providers →3.1065.0, oxfmt 0.47→0.54, and others.

2. Two major bumps, neither requiring source changes:

   • cytoscape-dagre 2.5.0 → 4.0.0 — swaps the abandoned dagre@0.8.5 engine for the maintained @dagrejs/dagre fork (bundled into dist/ in v4) and ships a proper ESM entry. The cytoscape peer dep is unchanged (^3.2.22; we're on 3.34) and all layout option names we use are unchanged, so Graph.tsx, layoutConfig.ts, and the module shim are untouched.
   • lint-staged 16 → 17.0.7 — v17's breaking changes don't affect us (min Node 22.22.1 vs our 24.16; the now-optional yaml dep, while our config is JSON in package.json). The pre-commit hook needs no changes.

Decisions worth noting for review

• oxlint held at 1.62.0 (not bumped to 1.69.0): 1.69 enables new default rules that flag 26 pre-existing files. Isolated to a future change to keep this upgrade free of unrelated source edits. oxfmt still bumped to 0.54.0 (zero reformatting drift).
• @types/node held on the 24.x line (24.13.1) to stay aligned with the Node 24 runtime, rather than moving to 25.
• A few versions are pulled back from npm-latest to satisfy the repo's minimumReleaseAge (24h) gate: @types/node 24.13.1, jotai 2.20.0, aws-sdk 3.1065.0.

Validation

• pnpm checks passes (lint, format, types) across all 4 projects.
• pnpm test passes — 160 files / 1778 tests on Vitest 4.1.8.
• pnpm build produces a clean production build.
• The minor/patch and cytoscape-dagre branches were manually tested against a live graph; all Hierarchy (TB/BT/LR/RL) and Subway layouts render correctly with the v4 dagre engine.

Related Issues

• N/A

Check List

• I confirm that my contribution is made under the terms of the Apache 2.0 license.
• I have verified pnpm checks passes with no errors.
• I have verified pnpm test passes with no failures.
• I have covered new added functionality with unit tests if necessary.
• I have updated documentation if necessary.