chore(deps): update dev dependencies, patch audit advisories, drop obsolete node-sass CI (#6078)

* chore(deps-dev): update dev dependencies

Routine build/tooling maintenance — every bump is a devDependency, so
the published package (dist/ + src/) is byte-for-byte unaffected.

- astro 7.0.4 → 7.1.3 (supersedes Dependabot #6077)
- @astrojs/mdx 7.0.0 → 7.0.3
- @typescript-eslint/{eslint-plugin,parser} + typescript-eslint 8.62.1 → 8.65.0
- eslint 10.6.0 → 10.7.0
- eslint-plugin-unicorn 69.0.0 → 72.0.0
- autoprefixer 10.5.2 → 10.5.4
- happy-dom 20.10.6 → 20.11.0
- postcss 8.5.16 → 8.5.21
- prettier 3.9.4 → 3.9.6
- sass 1.101.0 → 1.101.3
- stylelint 17.14.0 → 17.14.1
- terser 5.48.0 → 5.49.0
- vitest 4.1.9 → 4.1.10

eslint-plugin-unicorn 72 adds two new flat/recommended rules; disable
them following the existing curated convention — isolated-functions
misfires on Playwright page.evaluate callbacks referencing injected
browser globals, and prefer-simple-condition-first is a stylistic source
refactor that is out of scope for a version bump.

TypeScript held at 6.0.3: @typescript-eslint 8.65 caps its peer range at
<6.1.0, so TypeScript 7 is not yet supported by the lint toolchain.

Verified with `npm run production`: lint + 30 tests + full dart-sass/JS/
docs build + bundlewatch all green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci: remove obsolete node-sass CSS workflow

The SCSS adopted the Dart Sass module system (@use "sass:map",
map.keys(), …) in 483117d (v4.1.0), which the deprecated node-sass /
libsass compiler cannot parse — so this workflow failed on every
pull_request, showing red on all Dependabot PRs even though the actual
build is fine.

libsass support was intentionally dropped; AdminLTE now requires Dart
Sass. The workflow's only other purpose — asserting no `$` Sass
variables leak into the compiled CSS — is already covered by stylelint
and by the dart-sass build that a11y.yml and bundlewatch.yml run. No
branch-protection rule required this check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(deps): patch axios & shell-quote advisories via overrides

Resolves all 4 remaining `npm audit` findings (0 vulnerabilities now).
Both are dev-only transitive deps; fixed by advancing the overrides
rather than downgrading tooling:

- axios 0.32.0 → ^0.33.0 (bundlewatch): 0.33.0 is the patched 0.x
  release, clearing the DoS / prototype-pollution / proxy advisories
  (GHSA-42h9-826w-cgv3, -pmv8-rq9r-6j72, -mmx7-hfxf-jppx, et al.).
- shell-quote → ^1.10.0 (concurrently + npm-run-all): clears the
  quadratic-complexity parse() DoS (GHSA-395f-4hp3-45gv).

Verified: `npm audit` clean, `npm run production` green, and a
concurrently smoke run parses/executes commands correctly under
shell-quote 1.10.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Aigars Silkalns

.github/workflows/node-sass.yml

@@ -64,13 +64,17 @@ export default [
       'unicorn/prefer-spread': 'off',
       'unicorn/prefer-string-replace-all': 'off',
       'unicorn/prevent-abbreviations': 'off',
-      // Rules introduced in newer eslint-plugin-unicorn releases (v65–v68).
+      // Rules introduced in newer eslint-plugin-unicorn releases (v65–v72).
       // Disabled to preserve AdminLTE's established conventions: Bootstrap-style
       // `_element`/`_config` fields, modules that auto-init via top-level side
       // effects, and the abbreviation/`forEach`/dataset style already curated
       // above (these are renames of rules already disabled). Adopting any of
       // them is a deliberate source refactor, out of scope for a version bump.
+      // `isolated-functions` also misfires on Playwright `page.evaluate`
+      // callbacks that reference browser-context globals injected at runtime.
       'unicorn/consistent-boolean-name': 'off',
+      'unicorn/isolated-functions': 'off',
+      'unicorn/prefer-simple-condition-first': 'off',
       'unicorn/consistent-conditional-object-spread': 'off',
       'unicorn/dom-node-dataset': 'off',
       'unicorn/filename-case': 'off',